Overview
overview
7Static
static
711b33f7d60...18.exe
windows7-x64
711b33f7d60...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ze.dll
windows7-x64
7$PLUGINSDI...ze.dll
windows10-2004-x64
7Analysis
-
max time kernel
135s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 07:35
Behavioral task
behavioral1
Sample
11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsResize.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsResize.dll
Resource
win10v2004-20240419-en
General
-
Target
11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe
-
Size
347KB
-
MD5
11b33f7d609534d8b66f5a0822e4de3e
-
SHA1
54cc7edad01925b04322dac8098c6dda87cefa06
-
SHA256
210208179e5b58d849558ed55409a45dbc276935a4da1b5e53ec4745c7eb831c
-
SHA512
5bcc15d139987691f797fc51e59bb7749ac605247137a56ed351404b01b07c34a4b7b09554a62485bd1194c13376c7442138f64fd33f1fd2d72806dda3100067
-
SSDEEP
3072:94URpNUUX6z/DBXJfo/wGP2z5hS9u5rO+IpemPQ+Qir+2v:94SUjhto00HemPJrv
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023b8a-12.dat acprotect behavioral2/memory/3816-22-0x0000000074230000-0x0000000074239000-memory.dmp acprotect behavioral2/memory/3816-21-0x0000000074230000-0x0000000074239000-memory.dmp acprotect behavioral2/memory/3816-17-0x0000000074230000-0x0000000074239000-memory.dmp acprotect -
Loads dropped DLL 16 IoCs
pid Process 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe 3816 11b33f7d609534d8b66f5a0822e4de3e_JaffaCakes118.exe -
resource yara_rule behavioral2/files/0x000a000000023b8a-12.dat upx behavioral2/memory/3816-22-0x0000000074230000-0x0000000074239000-memory.dmp upx behavioral2/memory/3816-21-0x0000000074230000-0x0000000074239000-memory.dmp upx behavioral2/memory/3816-17-0x0000000074230000-0x0000000074239000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD534466cab38abcbc09ffac768d526f896
SHA12684f5f6c2b005cba812fc8cc1157777554fa3a3
SHA2568b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c
SHA5125c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7
-
Filesize
2KB
MD515bc05254befee3f2e2a80ff8569a956
SHA14628b2d50b22b03334ee55f6f120ad90698ddea0
SHA256c6e61e998270aafbf71a482675ba4e449625e70a2bf574d3c7487c6dbf141b9d
SHA512177cf714ee16864ceb235a2b7623a3cc3de1defae913342736d11897093524302a390cc9efb79f17fc613d2c8c96bce1bf14c6d7bb012d45069b916d4eb3fed9
-
Filesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de