Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe
-
Size
147KB
-
MD5
fd89a9fb23376d57089020b79f76e7ca
-
SHA1
e4ef52e5b827454176e140ca45cc1fd71ed63b65
-
SHA256
96a4c6e389046561363fbe35ce16ca1aee20608c85efa9648f0144c232de4655
-
SHA512
bdea29cea22f46a72ff8844ad614b104335882b5e91908a6c2958ee7df512e7435783391b95b5ef891fc9d6eb44308da34e38a6d6979fba195cb4723c011550a
-
SSDEEP
3072:iizZFNJorbOiBiEUlyYWHG9LITZI9Oive12DcbJds1uj3Gw/o:HVFNeRrHGJr1G12DOJegj35/
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftInstaller41 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe" fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\miniinstallerOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe" fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\InternetExplorer11.00.19041.746.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\WidevineCdm\_platform_specific\win_x64\widevinecdmWidevine.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunchwmpconfig.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\WORDPADWordpadFilter.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\MicrosoftTools.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\sdffdfcSoftWare.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\ExplorerInternet.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFrameworkfwrscsf3.0.6920.91356.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\sdffdfcfwrscsf1.2.8800.00108171148.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\wmplayerwmplayer.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\FrameworkMicrosoft.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\Dataresources.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\Windowssetupwm.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SoftWareSystem284.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Visualonramp.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\ChromiumLink.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\de-DE\BetriebssystemMicrosoft.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\Installer\setupexeMicrosoft127.0.2651.86.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AcrobatAdobe.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\it-IT\msader15Operating10.0.19041.1.160101.0800.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\pdf417pmpqrcodepmp.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\TipTsfTabTip32.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\fwrscsfsdffdfc4.6.3311.0.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewerPhotoViewer.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\fwrscsfSoftWare.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\SystemEntity.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\UpdateMicrosoft.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProvidersresources283.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Installer\setupexeEdge.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\dexploitationresources3.0.6920.9135.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Visualfrom.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\Operatingtifffilt10.0.19041.746.160101.0800.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\de-DE\sdffdfcsdffdfc.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Systemsystem3.5.30729.9141.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\EdgeUpdate.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\FrameworkSTLCLR.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\Componentsd3dcompiler43.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\WindowsImagingDevices10.0.19041.1.160101.0800.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\fwrscsfSoftWare.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\resourcesFramework.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\sdffdfcfwrscsf.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcqPhotoViewer.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\AdobeWindowsMedia.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\ManagerAdobe.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\resourcesUIAutomationTypes.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\BrowserAcroPDFImpl.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\fwrscsfsdffdfc.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\AdobeAdobe.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\sdffdfcsdffdfc13.0.0.23309.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcqWindows.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\msado15msador1510.0.19041.1.160101.0800.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\sdffdfcfwrscsf.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Multimedia Platform\Windowssqmapi.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\AdobeCreate.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AdobeMultimedia.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\WindowsWMPNSSCI12.0.19041.1.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sdffdfcfwrscsf.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.86\EBWebView\x86\WebViewClient.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceserviceFirefox.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\EBWebView\x64\WebViewBrowser.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\SystmemshwLatin.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\PackageManagementSistema.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\uk-UA\SoftWarefwrscsf.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\MicrosoftSystem.exe fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe 1544 fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd89a9fb23376d57089020b79f76e7ca_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2820,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:81⤵PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD5fd89a9fb23376d57089020b79f76e7ca
SHA1e4ef52e5b827454176e140ca45cc1fd71ed63b65
SHA25696a4c6e389046561363fbe35ce16ca1aee20608c85efa9648f0144c232de4655
SHA512bdea29cea22f46a72ff8844ad614b104335882b5e91908a6c2958ee7df512e7435783391b95b5ef891fc9d6eb44308da34e38a6d6979fba195cb4723c011550a