0e1f1086d8e50e261d3c5182171f5d56cea4d376add5434412c1dd9fd2d17df9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
Size

87KB
MD5

281d30ff9aedb2d4ad9fed57faa786c2
SHA1

ac6a3c95cbfb3e32e700a88e20a99032b4cedc73
SHA256

0e1f1086d8e50e261d3c5182171f5d56cea4d376add5434412c1dd9fd2d17df9
SHA512

75552872fa111d20b1db50db157ad50b39497d772fa4158b1244595e0a1095c3d60c881894a1bd13c8b353d82d60736445de6904daa73f9941078acb10383272
SSDEEP

1536:yOF3OLr5Oi3hhOSmXjQXNhXm558NSY1WMaUXXunq:DO/vwXwNhokSTjE

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files\desktop.ini	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\desktop.ini	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\tr.txt	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ro.txt	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msdaprsr.dll	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\ado\msader15.dll	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\ConfirmUpdate.jtx	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\msdasql.dll	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\281d30ff9aedb2d4ad9fed57faa786c2_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.6MB

MD5
3b95f219531ba8f62b0af921a267326d

SHA1
7057cbf263c55ce0ce034ed2b9ec3c9e1e8e170b

SHA256
fba91bc92ee1ee0ed3f51f59f0b2ec97dcc22cdc12528ada7626bf57c874c330

SHA512
8e82d53ae40849ebcbb747cdb38855691d56ee3a5d2b45ab52f0ca01be60f58d79a3224edc5feccba4de1bfbbeb24484c44d0782352911a3bde8e03e36df888d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit