Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 07:05
Behavioral task
behavioral1
Sample
40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe
-
Size
20KB
-
MD5
40a9fc7099d6d3da44a19d9676c19522
-
SHA1
b796fc6810499cd65362ac5f681e942e461eac2a
-
SHA256
b93edf39f2db71e328c6240d7249c083aac2637095b83bd3f80166abbee0ef08
-
SHA512
2a5b1b19182064f5a16dc6f69b8ef230b394ede0caf1d554656646a1246e05beb1a346c4abfe14d6c000355a632077a332bcb3a4afd62b295a060a458cebd1a5
-
SSDEEP
384:judrXUQS7OmS3kHot6h8lbezwPiwjAd0GutCSSfcxD1MStP9MAIThjvRA9:j4X2tHoteAbezoiwjAd0GSBxDbtPuACx
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4992 44.exe -
resource yara_rule behavioral2/memory/3488-0-0x0000000000400000-0x00000000007E2000-memory.dmp upx behavioral2/files/0x00080000000234af-5.dat upx behavioral2/memory/3488-509-0x0000000000400000-0x00000000007E2000-memory.dmp upx behavioral2/memory/4992-518-0x0000000000400000-0x00000000007E2000-memory.dmp upx behavioral2/memory/3488-517-0x0000000000400000-0x00000000007E2000-memory.dmp upx behavioral2/memory/3488-521-0x0000000000400000-0x00000000007E2000-memory.dmp upx behavioral2/memory/4992-522-0x0000000000400000-0x00000000007E2000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\46.exe 44.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\dotnet\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\VideoLAN\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\46.exe 44.exe File opened for modification C:\Program Files\Java\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\MSBuild\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Portable Devices\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Security\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsPowerShell\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\46.exe 44.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\46.exe 44.exe File opened for modification C:\Program Files\Crashpad\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\Google\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Uninstall Information\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Defender\46.exe 44.exe File opened for modification C:\Program Files\Reference Assemblies\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Crashpad\46.exe 44.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\46.exe 44.exe File opened for modification C:\Program Files\Microsoft Office 15\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\46.exe 44.exe File created C:\Program Files (x86)\MSBuild\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\46.exe 44.exe File created C:\Program Files\Common Files\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files (x86)\Google\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Portable Devices\46.exe 44.exe File opened for modification C:\Program Files\Windows Photo Viewer\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\46.exe 44.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\46.exe 44.exe File created C:\Program Files\ModifiableWindowsApps\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\WindowsApps\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Photo Viewer\46.exe 44.exe File opened for modification C:\Program Files\WindowsPowerShell\46.exe 44.exe File created C:\Program Files\Crashpad\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\Windows Multimedia Platform\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files (x86)\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Defender\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\46.exe 44.exe File opened for modification C:\Program Files\Mozilla Firefox\46.exe 44.exe File opened for modification C:\Program Files\Windows Mail\46.exe 44.exe File created C:\Program Files\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\ModifiableWindowsApps\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Google\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Mail\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\46.exe 44.exe File opened for modification C:\Program Files\Uninstall Information\46.exe 44.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SchCache\46.exe 44.exe File created C:\Windows\apppatch\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\Migration\46.exe 44.exe File created C:\Windows\DiagTrack\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\Provisioning\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\diagnostics\46.exe 44.exe File opened for modification C:\Windows\uk-UA\46.exe 44.exe File created C:\Windows\Containers\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\ja-JP\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\rescache\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\WinSxS\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\Help\46.exe 44.exe File opened for modification C:\Windows\IME\46.exe 44.exe File opened for modification C:\Windows\Offline Web Pages\46.exe 44.exe File opened for modification C:\Windows\Boot\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\uk-UA\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\Branding\46.exe 44.exe File opened for modification C:\Windows\ImmersiveControlPanel\46.exe 44.exe File created C:\Windows\ServiceProfiles\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\AppReadiness\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\Cursors\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\fr-FR\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\TAPI\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\uk-UA\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\Vss\46.exe 44.exe File created C:\Windows\appcompat\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\PLA\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\InputMethod\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\Logs\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\ShellComponents\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\ShellExperiences\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\LiveKernelReports\46.exe 44.exe File opened for modification C:\Windows\Logs\46.exe 44.exe File opened for modification C:\Windows\rescache\46.exe 44.exe File opened for modification C:\Windows\IdentityCRL\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\twain_32\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\apppatch\46.exe 44.exe File opened for modification C:\Windows\TAPI\46.exe 44.exe File created C:\Windows\ImmersiveControlPanel\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\schemas\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\Setup\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\Fonts\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\Offline Web Pages\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\InputMethod\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\GameBarPresenceWriter\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\INF\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\it-IT\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\tracing\46.exe 44.exe File created C:\Windows\de-DE\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\diagnostics\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\schemas\46.exe 44.exe File opened for modification C:\Windows\apppatch\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\Performance\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\CSC\46.exe 44.exe File opened for modification C:\Windows\en-US\46.exe 44.exe File created C:\Windows\Installer\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File opened for modification C:\Windows\Containers\46.exe 44.exe File opened for modification C:\Windows\ModemLogs\46.exe 44.exe File opened for modification C:\Windows\Registration\46.exe 44.exe File opened for modification C:\Windows\SKB\46.exe 44.exe File opened for modification C:\Windows\System\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe File created C:\Windows\IdentityCRL\44.exe 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3488 wrote to memory of 4992 3488 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe 89 PID 3488 wrote to memory of 4992 3488 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe 89 PID 3488 wrote to memory of 4992 3488 40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40a9fc7099d6d3da44a19d9676c19522_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\$Recycle.Bin\44.exeC:\$Recycle.Bin\44.exe $12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4992
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD540a9fc7099d6d3da44a19d9676c19522
SHA1b796fc6810499cd65362ac5f681e942e461eac2a
SHA256b93edf39f2db71e328c6240d7249c083aac2637095b83bd3f80166abbee0ef08
SHA5122a5b1b19182064f5a16dc6f69b8ef230b394ede0caf1d554656646a1246e05beb1a346c4abfe14d6c000355a632077a332bcb3a4afd62b295a060a458cebd1a5
-
Filesize
102B
MD5c9d73113b4ade041cdaabbd6550c4322
SHA14592c860d17711242590629858f17fee84abc9be
SHA2564d7fdd2053313637af15eb8571adbb65afa19d61d04ef013a7a1e9086f248f12
SHA5125cee938f9f95e364776ce07b821cfe5f65ba4a179da6c62490b563017cd1c87605293135d6622a94b0c811e271427fb46694afb32448ec7dc38ef837adb090cc