8ded8d5d4f223e40ea5c192f42f6cf845b2cf713f6f5083ab0c3c4c179ab2af3

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
Size

92KB
MD5

c202821e262eb88e5e32df90a00ee6d4
SHA1

18612a1623bb24d4e3bcaefd71677c9f52c2eff3
SHA256

8ded8d5d4f223e40ea5c192f42f6cf845b2cf713f6f5083ab0c3c4c179ab2af3
SHA512

81ac7d3dafc7bf4f185e891cb80f71158417e5edfd5f52937dc1d1dfa13e495383affefe3690f9391194c324828db15db789223e5b7240eead61ab5ca9d53dad
SSDEEP

1536:yOF3OLr5OpiVlwlGmEFMFn4eOTeY+TGx7WHlwlk:DO/Yi2EFMFn3O5+Tyin

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File created	\??\c:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File created	\??\c:\Program Files\desktop.ini	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\desktop.ini	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\VGX\VGX.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\BackupSet.ppsm	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\fxplugins.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\ktab.exe	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\README.txt	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\hmmapi.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jvisualvm.txt	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\idlj.exe	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\security\java.policy	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ca.txt	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\oledbjvs.inc	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\af.txt	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ru.txt	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ug.txt	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\tg.txt	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\README.html	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\lib\jfr\default.jfc	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4620	1176	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c202821e262eb88e5e32df90a00ee6d4_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 1016
  2⤵
  - Program crash
  PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1176 -ip 1176
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
2ea6b2f81c1f4897693eec42d3c8e71c

SHA1
923b3aa7dfe225b607d5f0f07058505b341a272f

SHA256
c4f32bef8c98328f273551debfba1dd04c26dd0fff53bb6e9efa950802cb2900

SHA512
b9e5d48fe9e65d05ab5e6595bf48a1b54d7016652d181198ed7a2532e647fa1be5aa5c38b69368138292d850a1c1b6c75075393f9076badce6fe81c1734ce7db

Download Submit
C:\Program Files\MeasureSend.aiff

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK

Filesize
119B

MD5
da7c482f5358bd9da5bbfe76e3447a8e

SHA1
dc0e0a748e790dc04133c65b52cd69b1676bd9c2

SHA256
4a4c9f290dadb6052556670faf60e07f0cc3c6f5a7b478d2da2234be8ea5508b

SHA512
e9bb5f64535ebed8a4f38bc4144b3dc4dedcf6a3010a87a0cfa2306fbdc5ce8d3e9fd00ad9ae019548b3085edca33283c507325a6c484f66b484778a035878bc

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK

Filesize
118B

MD5
805ae32d41bd54cee2613872031b2c20

SHA1
5c2201ef44d4c345c2ad40bf67c3cb5f17509bad

SHA256
641723ac1f2a767466006fb811f8140370ef9f2904398ee77f160c0e7bda7ba0

SHA512
a40328c1800ff312c79e873b9cdc1cc8fd4b61629fcf379257401b167c45fa53c3a019eb1bc6fb55ae8e9e74b9ad8e226163d75918f564e787f57696670688b0

Download Submit