Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2024 12:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe
-
Size
232KB
-
MD5
b795f350238fddb6fc48a50add90daff
-
SHA1
e7a6dd4b4ef3f74ec51c7e2210174b1697e1a893
-
SHA256
5c407f0222dd4b19ce5fbb6404d938d908d531bda1429aa34eae85b5783f9438
-
SHA512
7f66310ec564a821dd915d2ce6902953ec5e80c97377193ad196ab49d0e12b9d27e34c7327631704a934ebe4c85503cc46b7fc1403abece504776cf2c4b80ed2
-
SSDEEP
3072:xGXYXglra/2gmxPmVYT9eSwrweBv3Lp/v4s/lIhB/s+F8lv1DbO38Cb3CB0Pm:gXRJPmVYZeSyXvd/7H+Wp1u3VuK
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\msedgeupdateres_am.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\psuser_64.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\Microsoft.PowerShell.PackageManagement.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilt.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_cs.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\WordpadFilter.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\psmachine_64.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\msedgeupdateres_ca-Es-VALENCIA.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ca.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIBUtils.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\playreadycdm.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msdaremr.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ml.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ja.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_fil.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaenum.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PowerShell.PackageManagement.resources.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\msedgeupdateres_fi.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\penchs.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ru.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_zh-TW.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_tr.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ta.dll b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b795f350238fddb6fc48a50add90daff_JaffaCakes118.exe