Overview
overview
7Static
static
7ebb72faf04...18.exe
windows7-x64
7ebb72faf04...18.exe
windows10-2004-x64
7$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...RL.dll
windows7-x64
3$PLUGINSDI...RL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...eb.dll
windows7-x64
3$PLUGINSDI...eb.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
1$PLUGINSDI...ss.dll
windows10-2004-x64
1$PLUGINSDI...nit.js
windows7-x64
1$PLUGINSDI...nit.js
windows10-2004-x64
1$PLUGINSDI...o.html
windows7-x64
1$PLUGINSDI...o.html
windows10-2004-x64
1$PLUGINSDI...ge.dll
windows7-x64
3$PLUGINSDI...ge.dll
windows10-2004-x64
3$PLUGINSDI...n12.js
windows7-x64
1$PLUGINSDI...n12.js
windows10-2004-x64
1$PLUGINSDI...ime.js
windows7-x64
1$PLUGINSDI...ime.js
windows10-2004-x64
1$PLUGINSDI...ket.js
windows7-x64
1$PLUGINSDI...ket.js
windows10-2004-x64
1$PLUGINSDI...ftp.js
windows7-x64
1$PLUGINSDI...ftp.js
windows10-2004-x64
1$PLUGINSDI...ttp.js
windows7-x64
1$PLUGINSDI...ttp.js
windows10-2004-x64
1$PLUGINSDI.../tp.js
windows7-x64
1$PLUGINSDI.../tp.js
windows10-2004-x64
1$PLUGINSDI...re.dll
windows7-x64
1$PLUGINSDI...re.dll
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 18:26
Behavioral task
behavioral1
Sample
ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/CustomBrandingURL.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/CustomBrandingURL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/CustomNSISdl.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/CustomNSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/CustomnsWeb.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/CustomnsWeb.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/FloatingProgress.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/FloatingProgress.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/GuiInit.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/GuiInit.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/IntegratedOffer-Magoo.html
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/IntegratedOffer-Magoo.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/LuaBridge.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/LuaBridge.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/LuaSocket/lua/ltn12.js
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/LuaSocket/lua/ltn12.js
Resource
win10v2004-20240319-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/LuaSocket/lua/mime.js
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/LuaSocket/lua/mime.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/LuaSocket/lua/socket.js
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/LuaSocket/lua/socket.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/LuaSocket/lua/socket/ftp.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/LuaSocket/lua/socket/ftp.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/LuaSocket/lua/socket/http.js
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/LuaSocket/lua/socket/http.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/LuaSocket/lua/socket/tp.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/LuaSocket/lua/socket/tp.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/LuaSocket/mime/core.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/LuaSocket/mime/core.dll
Resource
win10v2004-20240226-en
General
-
Target
ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe
-
Size
895KB
-
MD5
ebb72faf044287d42bc7b6e61ce16e12
-
SHA1
1d32e0ed9b37801b3ab4d0d7fd6e33de6e94b4ba
-
SHA256
ece8264f31c14457e2663a3a674c0e8b133f1218ac8106eab16c72cb0263b85b
-
SHA512
39679cc759c68c3949ebee5e5be76709b05112b6f7dd4c93c8e64dae0811b54496926173b4454ba79a0c45d8026d00608e04df6155659e8bec524197c2379ea6
-
SSDEEP
24576:nLdzmeYogsmJ5tqpRbENylkB777Z0ufXOhcY06fOVOmoy:nLU5wjbNlkB7771fXOyYsOmoy
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 3048 ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe 3048 ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe 3048 ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe 3048 ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe 3048 ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe 3048 ebb72faf044287d42bc7b6e61ce16e12_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x000000000082B000-memory.dmp upx behavioral1/memory/3048-218-0x0000000000400000-0x000000000082B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55760482fa9fccd3e77fbc2cf7ca1e834
SHA156ca024ddef698d6cb93912b96e1ee9cc5e2b1a8
SHA25645845d627d66283891d52fd2ee8af305c842b2d133f1943960dc1d62d965641f
SHA5125d49e2957f5c07dc157eb1e0af329f1eed18d34d0abe288ee60adbcd034448f086e3eb5a219ca9c77f77bb1d582bd215a753c9c0dd3fe14453753dde0301d3a8
-
Filesize
12KB
MD59781b7bb06ea11ebce5dc9d57b3437a3
SHA1604123977fffadebfefccae08df6b8e2e5dbab82
SHA256c26d867114a04c677ef9ac35d83c2d362c1fb9ff8d46abfb785d71a48cb9c309
SHA512666125abfb144665506e1085793656f31708211b940efca8188a5b20d57a058dcae10ec274a7614450f7b66854c9239c2838e61b3721c10482710a2008b681d7
-
Filesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
Filesize
80KB
MD54bf7db111acfa7c28ad36606107b3322
SHA16f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA256bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
SHA5120a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
-
Filesize
11KB
MD57292b642bd958aeb7fd7cfd19e45b068
SHA119a800620d041634abae5b5d096cb0e87ce4c188
SHA25690f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
-
Filesize
116KB
MD5bbc9ac3211f07e45510861ae429996c3
SHA10a0d7ea99c959cd4add3deb05e500af5fdf98510
SHA2562a4f510a75453fb49ceb2823756bdbcbfe1a026dcd27a76260229386776ddaad
SHA512f3a4a726ffd7869d277e9ee09a833cc27e10f117c52dd2a2efcc96cf9280730f10dcb704ea78a6d6f16ac2d2db1b94ad6025dfabaf83fdaaca4f5fbb0db1e756
-
Filesize
287KB
MD5ed7f7857933b38e5d10daf828e79af19
SHA17f1445f87f7e2256efc33ef56da20c3b23a1e0f9
SHA2569dd5218bc2d12f4d07e268bc6ec01d6eefde4b99a07246d0a96d18477d331b5b
SHA512ceaf9597d4cb725c4ec8b7af8d1090b38df102b52ca7606a24e9a094fc81f450f93ad22770c905db9115e271fa5fa4f5731caa7b1875e204edb10fb691741715