aeea472ff4e46cb41f942963ff03a836b89a2fb3c64b278e9e99f8b18b7f92b1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
Size

455KB
MD5

388d879f779e0c90265d0df2d003cade
SHA1

68e5a1647f6a74bf4fc14b27dd5e9b32ac780b83
SHA256

aeea472ff4e46cb41f942963ff03a836b89a2fb3c64b278e9e99f8b18b7f92b1
SHA512

edfafc628c31f0b103df772e060b685169ef084ff35d4ccabc233e747e025842d6e1ac81bdbdf67c88ab2680dd4a372287d9e9ef4f8496c2c55d42f717299e2f
SSDEEP

12288:uwFJEFMFnzix1c60yTix1c60yQEy1kT5v8J2qV5KV5izrqFkb3:xJEFMFnmt1kT5v8JdIifqFu3

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\desktop.ini	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\desktop.ini	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\dt.jar	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\zh-cn.txt	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Internet Explorer\jsdebuggeride.dll	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\msadc\handler.reg	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieproxy.dll	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\zh-tw.txt	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\388d879f779e0c90265d0df2d003cade_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
6.0MB

MD5
a02230c5647877ba6b175e134aeab4ff

SHA1
d1331fc1d645c36edb26333d90c8c64cde791ea8

SHA256
45b85137ebd792397bdfe4d138317391b964a4aeb3466191068ed22f2c27f528

SHA512
90920b1e2ae55c5ae83c920f5e4627dfddda2a67b2a49d9bee50c4098336d645c279b640486ab03fa6c1f69e6bbcb7a5b439454cdfcca70363f115b3c1724569

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
386b6087dd9575fc6b8ada0f7a463723

SHA1
5373d4ffd89438a60b8ae0858c3bc4e8d37f540a

SHA256
ef494685ac9644ba5672cfc49c6efe5e09a2d71706d5cf4b57171f7d5f7a70d1

SHA512
1d39dd2dd736431ebe0e7f16a9f10b748e522cfee03a187ad020708e48ed676a21eef6b3ac3b1f600cff2e19f1d30ca25f682fe773650b3fc97e20f0afd8557b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

Filesize
8KB

MD5
8ed35e04c7556933d923ee706f8312d7

SHA1
15b0c7aae539b756640e9d28e6f68d82bd5b9294

SHA256
f2f8e2280b4118ce0ecbf0c58b73fba5e9666f8cdb53fabe8a1fb6fbcd48e2c7

SHA512
3f37e8d86d9495f5a5ba4639c2b178d8c3ce0236d4578638630fc901fd4c6d0d40fd3e57e0e28ad9e049295425864a14bf32d1368769e19e749226c5ff84e84b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

Filesize
7KB

MD5
6a922ae3979f4cd80d73e62711c19826

SHA1
4cc0a5bf46db54e1c54059394fb9f64b95d4ef69

SHA256
9cd780aa41ad06ec2e7f40837e69fa0c02a8f069e51ca8c8622b5e43ab84fb61

SHA512
a285f8c0b5deb7a22bfe98c31c1bb44ad2cec3c512b0b0a018c6a8ca51718c6cbd5f805236dcf1c6d6e2b8a8f91d521b1653c055c9d71f67c4de5579047040f3

Download Submit