Overview
overview
10Static
static
30930b4b48c...18.exe
windows7-x64
100930b4b48c...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3begin_pass...1.html
windows7-x64
1begin_pass...1.html
windows10-2004-x64
1policies48...0.html
windows7-x64
1policies48...0.html
windows10-2004-x64
1tweet1845418885.html
windows7-x64
1tweet1845418885.html
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7vitamin-c-...t.html
windows7-x64
1vitamin-c-...t.html
windows10-2004-x64
1zoo.html
windows7-x64
1zoo.html
windows10-2004-x64
1General
-
Target
0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118
-
Size
277KB
-
Sample
240430-gsa3vsef3z
-
MD5
0930b4b48c0b81a15cf832743da7f70d
-
SHA1
3f04cf61baec2df50961ac845d24e12623455cbb
-
SHA256
1c158db04b4efc7e8440d25c4a4e16658bc43a0f084c3c16d9fa80f5fb9cfc95
-
SHA512
8c11c1e78811686ca3dd6c3abea125c72c95675d14800ccdf2bf63714ba6b6082575c1f8154b549fa15ade3f2462e1f3928fc48373e7906d42ec651304fd947c
-
SSDEEP
6144:eW+7+eM+M4aaZYy+ZZAIor1K3UC0A9ePfUZw1Ubu1:eRFM3aZYy+3horVV91
Static task
static1
Behavioral task
behavioral1
Sample
0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
begin_password_reset1850795531.html
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
begin_password_reset1850795531.html
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
policies484632680.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
policies484632680.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
tweet1845418885.html
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
tweet1845418885.html
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
vitamin-c-pink-grapefruit.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
vitamin-c-pink-grapefruit.html
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
zoo.html
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
zoo.html
Resource
win10v2004-20240419-en
Malware Config
Extracted
C:\Users\Admin\Pictures\README.hta
Targets
-
-
Target
0930b4b48c0b81a15cf832743da7f70d_JaffaCakes118
-
Size
277KB
-
MD5
0930b4b48c0b81a15cf832743da7f70d
-
SHA1
3f04cf61baec2df50961ac845d24e12623455cbb
-
SHA256
1c158db04b4efc7e8440d25c4a4e16658bc43a0f084c3c16d9fa80f5fb9cfc95
-
SHA512
8c11c1e78811686ca3dd6c3abea125c72c95675d14800ccdf2bf63714ba6b6082575c1f8154b549fa15ade3f2462e1f3928fc48373e7906d42ec651304fd947c
-
SSDEEP
6144:eW+7+eM+M4aaZYy+ZZAIor1K3UC0A9ePfUZw1Ubu1:eRFM3aZYy+3horVV91
Score10/10-
Blocklisted process makes network request
-
Contacts a large (516) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Deletes itself
-
Loads dropped DLL
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
3e6bf00b3ac976122f982ae2aadb1c51
-
SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
-
SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
-
SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
SSDEEP
192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
dbdbf4017ff91c9de328697b5fd2e10a
-
SHA1
b597a5e9a8a0b252770933feed51169b5060a09f
-
SHA256
be60a00f32924ccbe03f9914e33b8e1ad8c8a1ca442263a69896efba74925b36
-
SHA512
3befc15aab0a5dbe7fde96155b0499d385f2799b1a2d47ce04f37b5804006b1c6c4fff93d3cedb56a2a8172b23752b6f9dc6168cfce3596b91def3247836cf10
-
SSDEEP
96:33YnIxFkDUGZpKSmktse3GpmD8pevbE9cxSgB5PKtAtYE9v5E9KntrmfVEB3YdkS:33YIvGZDdtP8pevbg0PuAYK56NyoIFI
Score3/10 -
-
-
Target
begin_password_reset1850795531.html
-
Size
10KB
-
MD5
1f43d09b0d775cf5b3e7a83f681ee05f
-
SHA1
3fcc889aba5d629fe03545dc9b6090d240359529
-
SHA256
970431d4f6a49626e92402520b25ac0bf670ec0772ae7eb98ab52d8664c2a34c
-
SHA512
40bc9b3415e574676fb8282e85a6c6a53be509f50753cbd703a8926701e9f56b29c30bfe0570f61882906048ab8b55ef3788ee941bcfe5a7032c90c115d4661c
-
SSDEEP
96:lbRAxWMo9PynfKoBFLaDNPkew5zBxuALF/5bZwjFbZWKVJ+cHzTNvY:lbUWt9PyiovLOZHAzHDVwlZjtHzBA
Score1/10 -
-
-
Target
policies484632680.html
-
Size
9KB
-
MD5
469afd13ec8b7255cf9861321efa0c28
-
SHA1
ad60e9b8c63791cf5cd8e5d259d95532268aed41
-
SHA256
740e07665bf8958bb6b99b39f9277e2618737a8ef994bbf039f376d064ca28b3
-
SHA512
03f1ba22ee860badbe4d7952c346658afd9bb653cd3da222c8e68fadefda869a148f81321ee6d55e24e6c70f179e888c899b2ca75ba1b7f8fc8c3990435034b6
-
SSDEEP
192:11lgH3YSHEpUA4sePED+AeoWpt1+hhkjSOAMr3:11lgonpUAFd7eoWpt1Maj9T3
Score1/10 -
-
-
Target
tweet1845418885.html
-
Size
4KB
-
MD5
f82b2551b5da96dcd142287a12455c99
-
SHA1
3b28fa86b478bb1a718a9ff7928bee8ce5f14fff
-
SHA256
c8bdd9557bf8df017daee73a6053a940c6afa3819e374ec8522cbd725b0f9408
-
SHA512
52d9e8db40e1c3060c3648a3c376718de75acae640099b8141916e2d61533b807a7ed8610a9678a9dcda844cf9918d6c2fe8d3c9968724c0c91bfd25b644209b
-
SSDEEP
96:r/CKbKJ9DbXhOrPGl/R8TVXyED/gA0jJzka83A5f2a8G1KgRgG:rqQKJ9DbXhOjU/R85XZD4tjJN83C2azD
Score1/10 -
-
-
Target
uninstall.exe
-
Size
61KB
-
MD5
395b51218583e47a7358e044acc3448b
-
SHA1
c47fbb0aec595d8551c777f3016a142630ac6780
-
SHA256
fcdadb8a0173828def8f1eddbe6fadbcecdd9296dc0c7b45ba7135b2db04d621
-
SHA512
4418e37cde0fb403307344b53d84b2a167473311dcad3981b4ed3aeec2c31d441a9dbc2640a103d4be17b3facc8881a33e82b33bd508f281a2accb200934dfab
-
SSDEEP
1536:ejoUxZbE+HOI66qkryz9zIMg/EW58gL0AzCVhf3:edxNE+Hb+eyz9zIMeEW530AYv
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
vitamin-c-pink-grapefruit.html
-
Size
24KB
-
MD5
e42eb4f2ffa46a31b84728fc4f59948a
-
SHA1
6d48c9691dec1790336e36eced5bb93789a8294b
-
SHA256
739c32b0da18bca3ce2b7b284fd19e99ec59e8252002c08ffd6ddf154354bace
-
SHA512
0f0ca67e1029d1425ea6499495d79a4627b4609fcf68d9fbc73bb418168dd690df7de351b633dae8d27d8a0b6feb30373260b03922e6dba271a85ce94ce051a3
-
SSDEEP
384:XXQd00gJp5EYKSc3H3jnnKSZ3W32gKSFxKSb9CbTKSHiYfKSO10DL2bdrp2CUind:XXTTPJrpNnzjcOXfAq57JMMCw
Score1/10 -
-
-
Target
zoo
-
Size
20KB
-
MD5
88538df19003582f822a403c9e10bf45
-
SHA1
818a0d2b7883090cca53ebd20ea22792c434eeda
-
SHA256
5b8a5147236aa02f35ff811c2b4299ff186bbe6a7e0f1bcaddc17c1f47b02f38
-
SHA512
3173b04fa8f77f0f64ab9d6aa8c5d0970bc1882e5e3d726e4147b8305e13e082eed37c800686da125edc6e738953adf4bc98122e7cbc381f3280765612038a5d
-
SSDEEP
384:xC7FFJHWfaddUh1AfurwpIClBFosnqjVN9duWkolBJ:w7FFJ2hrrPyLoCYVNrvlX
Score1/10 -