afe37f3331a9ee0d98f61fd6f71bd6af034fea7b0ec89a4bb11e5c38ad2c9b88

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
Size

154KB
MD5

54a6a70f8f973cc30889e89afd961a45
SHA1

9d9ecbcd1d89d9f9e3240e51cbf4567f8f210bd6
SHA256

afe37f3331a9ee0d98f61fd6f71bd6af034fea7b0ec89a4bb11e5c38ad2c9b88
SHA512

d69201bc5ac25be8300a9023e985aaac123270a39108a6d2a79e9d35184e8b7df441dc0732a9e9cfa2740583243075f77b5e57e8f357aed88d7faa8c90ff9676
SSDEEP

3072:DO/AUfk7NTb7HjneeKkOpn/J2CSRuUUBjxFhNGpWo7pwdz:yAWkhT7LRhW9FhNGpWapwdz

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\msadc\msdarem.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\msadc\msadco.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msadds.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\ado\msado27.tlb	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\soniccolorconverter.ax	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\cy.txt	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll

Filesize
5.7MB

MD5
81de5745c805d1273c1de1031e878400

SHA1
aa911fb9f850b5c91842103aa072707a8c8aec90

SHA256
f59b8e880b1563c3d953441baaa11aee7e989c0f95b155a6c4785a7e7729c3dd

SHA512
25d5b2905db5cf70459aa164f3fef335f54881935466a6c495ad3d4a00a2d64d0d94d5e31dc8989d151351b662820c154806c93f3034a5b341e7fecd83c2fd4f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
386b6087dd9575fc6b8ada0f7a463723

SHA1
5373d4ffd89438a60b8ae0858c3bc4e8d37f540a

SHA256
ef494685ac9644ba5672cfc49c6efe5e09a2d71706d5cf4b57171f7d5f7a70d1

SHA512
1d39dd2dd736431ebe0e7f16a9f10b748e522cfee03a187ad020708e48ed676a21eef6b3ac3b1f600cff2e19f1d30ca25f682fe773650b3fc97e20f0afd8557b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

Filesize
8KB

MD5
8ed35e04c7556933d923ee706f8312d7

SHA1
15b0c7aae539b756640e9d28e6f68d82bd5b9294

SHA256
f2f8e2280b4118ce0ecbf0c58b73fba5e9666f8cdb53fabe8a1fb6fbcd48e2c7

SHA512
3f37e8d86d9495f5a5ba4639c2b178d8c3ce0236d4578638630fc901fd4c6d0d40fd3e57e0e28ad9e049295425864a14bf32d1368769e19e749226c5ff84e84b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

Filesize
62B

MD5
f6dbc4b34179e10f9b6c0e2d5d24c2c6

SHA1
1c53d71700022886c41b568a9514924fd3c1c62b

SHA256
05df06e24037881941804db6ca15f7a25dd10a536b0f642e7a3d09de07256206

SHA512
25a2bc555f2e49610a0490377bf687188f7e13931cbd8e29482584e552b65a2e51fe84fa5153825517a011d7b65df831911c302ae482b23fa0b118524e8af24b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

Filesize
7KB

MD5
6a922ae3979f4cd80d73e62711c19826

SHA1
4cc0a5bf46db54e1c54059394fb9f64b95d4ef69

SHA256
9cd780aa41ad06ec2e7f40837e69fa0c02a8f069e51ca8c8622b5e43ab84fb61

SHA512
a285f8c0b5deb7a22bfe98c31c1bb44ad2cec3c512b0b0a018c6a8ca51718c6cbd5f805236dcf1c6d6e2b8a8f91d521b1653c055c9d71f67c4de5579047040f3

Download Submit