afe37f3331a9ee0d98f61fd6f71bd6af034fea7b0ec89a4bb11e5c38ad2c9b88

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
Size

154KB
MD5

54a6a70f8f973cc30889e89afd961a45
SHA1

9d9ecbcd1d89d9f9e3240e51cbf4567f8f210bd6
SHA256

afe37f3331a9ee0d98f61fd6f71bd6af034fea7b0ec89a4bb11e5c38ad2c9b88
SHA512

d69201bc5ac25be8300a9023e985aaac123270a39108a6d2a79e9d35184e8b7df441dc0732a9e9cfa2740583243075f77b5e57e8f357aed88d7faa8c90ff9676
SSDEEP

3072:DO/AUfk7NTb7HjneeKkOpn/J2CSRuUUBjxFhNGpWo7pwdz:yAWkhT7LRhW9FhNGpWapwdz

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	\??\c:\Program Files\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\GrantConfirm.xlsb	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\sqloledb.rll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\desktop.ini	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\io.txt	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4100	3940	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54a6a70f8f973cc30889e89afd961a45_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1000
  2⤵
  - Program crash
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3940 -ip 3940
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.9MB

MD5
a924e5e8e13974575da2cd6d632b44ae

SHA1
803a9c2edad15ddc65eccd3ba497d35c710f52b2

SHA256
8d3246efdafa58b3f7d0aee5b52b6e15322ca9c0d843030de918be0af599ea6e

SHA512
666537950a74f23ad1e99d1c45452db03a8c9b505ce36e1b8e1f004b5c875a7f91650602b0e56d45e3d33c30edc586a9de338b473c0b796412087531ec182ebc

Download Submit
C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll

Filesize
5B

MD5
b5b682b742431a52ea8b17c72ad9c572

SHA1
326320f469235708c59f678c9a7357dca552d306

SHA256
30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

SHA512
4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

Download Submit