Overview

overview

7

Static

static

7

36e4c15587...18.exe

windows7-x64

7

36e4c15587...18.exe

windows10-2004-x64

7

$PLUGINSDIR/BI.exe

windows7-x64

7

$PLUGINSDIR/BI.exe

windows10-2004-x64

7

$PLUGINSDI...CC.exe

windows7-x64

7

$PLUGINSDI...CC.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...lp.dll

windows7-x64

1

$PLUGINSDI...lp.dll

windows10-2004-x64

1

$PLUGINSDI...er.exe

windows7-x64

7

$PLUGINSDI...er.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...PIE.js

windows7-x64

3

$PLUGINSDI...PIE.js

windows10-2004-x64

3

$PLUGINSDI...ed.htm

windows7-x64

1

$PLUGINSDI...ed.htm

windows10-2004-x64

1

$PLUGINSDI...API.js

windows7-x64

3

$PLUGINSDI...API.js

windows10-2004-x64

3

$PLUGINSDI...ams.js

windows7-x64

3

$PLUGINSDI...ams.js

windows10-2004-x64

3

$PLUGINSDI...PIE.js

windows7-x64

3

$PLUGINSDI...PIE.js

windows10-2004-x64

3

$PLUGINSDI...Bar.js

windows7-x64

3

$PLUGINSDI...Bar.js

windows10-2004-x64

3

$PLUGINSDI...ore.js

windows7-x64

3

$PLUGINSDI...ore.js

windows10-2004-x64

3

$PLUGINSDI...min.js

windows7-x64

3

$PLUGINSDI...min.js

windows10-2004-x64

3

$PLUGINSDI...on2.js

windows7-x64

3

$PLUGINSDI...on2.js

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 22:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    36e4c155874405e78af27f9629aaa47e_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    36e4c155874405e78af27f9629aaa47e

  • SHA1

    a0b96af7f1889b67df8a25dbcb2d21ab9fae6c75

  • SHA256

    05e9bb0df411e4c57a2d41a6d5aa59e3669dffe8e47894c2c620147b64e950e4

  • SHA512

    3268a107b8c9d99c16176eaa586f378fb34f3b99b332a2314aa39e09b2bf7fdd34464de8a608fd0fec27a7403188f3017953f9c47c7c199f91646708ec24ef12

  • SSDEEP

    24576:f+RBEimd9kjEYZKlKVjXwUFl70i8lJj/gr0fh9:2YNfuEP2vFlejb59

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36e4c155874405e78af27f9629aaa47e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\36e4c155874405e78af27f9629aaa47e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\BI.exe { "json_send_time" : "11/5/2024 24:33:51:555" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "12367" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.7.9.130506.05" , "bundle_id" : "da332399-49e6-4d67-92e3-354562d1b9b4" , "machine_user_id" : "{0CC1E513-4D4B-4A5E-9DB3-F1549321182B}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "09BB0D89-E0BF-478F-96CE-0812E484DA32" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "Brothersoft" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1968
    • C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\BI.exe { "user_ie_security_level" : "" , "json_send_time" : "11/5/2024 24:34:40:477" , "internal_error_description" : "HttpPost result: try1- SendRequest Error; try2- SendRequest Error; try3- SendRequest Error" , "internal_error_number" : "3" , "is_parallel" : "0" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "12367" , "general_status_code" : "2" , "duration_details" : " InitPluginsDir:16 initializeParams:62 load_BITool:32 send_BI_Init:31 load_DownloadACC:15 retrieveUISource:0 unpack_webappfolder:79 unpack_icon:0 RetrieveMainOfferKey:0 unpack_OpenCandyDll:31 load_webapphost:0 unpack_ProxyInstaller:31 navigate_loadingUI:63 navigateAsync_constMainOffer:515 BuildUserProfile:0 retrieve cid:0 callService1:16094 callService1:16031 callService1:16031 " , "phase_duration" : "" , "error_details" : "Failed communicate with the DistributionEngineService. Inner Error: SendRequest Error " , "result" : "Error" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.7.9.130506.05" , "bundle_id" : "da332399-49e6-4d67-92e3-354562d1b9b4" , "machine_user_id" : "{0CC1E513-4D4B-4A5E-9DB3-F1549321182B}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "09BB0D89-E0BF-478F-96CE-0812E484DA32" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "Brothersoft" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\BI.exe
    Filesize

    75KB

    MD5

    6964bdfaed9fee6a60e24928a45c3c85

    SHA1

    57f9ae81840ae02483c9191e4f9d0209b033c817

    SHA256

    209b8cef0922660712526d81e593e4e367e848f255d686771e7914ea701ff7a5

    SHA512

    266df60f87737c4f9c0780a58bfb36eeef5c765e12fcc8c70d6a05e468e879acaf3c90fd7add1cc8cec39268d949a0509741ca61ffad09ec94bd7315ef4c6be5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\System.dll
    Filesize

    17KB

    MD5

    a4f38d1c7a480f5da1bb8097b8b939db

    SHA1

    b3129c2a0e61881381463f5e0cbbffa573daa845

    SHA256

    e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436

    SHA512

    fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\WebApp\Loading.htm
    Filesize

    3KB

    MD5

    780cee40c59628f748ee2eb73c264018

    SHA1

    75ccf4a0ffdb7b2a6d2589b63302a5e58b5a63c6

    SHA256

    c89d90d8200285205324b6fd09f215be1f6f7ad695ae48a5efda0eeb5fcbd62d

    SHA512

    6744fed67868e9112237efe0ffd29188d935735a3d81869befad5a8881142417fe74aba0f3ed271bf5ab0161410c395f221de25de5d32b7b5dad4d090b277656

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsv472D.tmp\webapphost.dll
    Filesize

    691KB

    MD5

    c7ae8a4fa8b45d5f6cfdef3350337105

    SHA1

    6bed42e4f5a9905f773d73a334d3ac579b5a8582

    SHA256

    bfaf19da88c0455c2e302a7905a49033f435ad75749c59a6e10e3838dcf8aa90

    SHA512

    1a3ca4a930431306ebe2da1e8269bdef758c587772e8ca1f6ad2dedf949b50a25e4273bd12069613069783d498023b4f1704de8bb3c502cb58ac900ba49c3782

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsv4817.tmp\inetc.dll
    Filesize

    29KB

    MD5

    dccdcb124064a1d9a5eb12232348b898

    SHA1

    f294fac154cb1c6c18fe054ac584f767594b93fb

    SHA256

    37adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e

    SHA512

    bd89bcd513bb7120db80e1115b4caceaa18c4ea863fe29b232002d447c3813133ff2849fcb2d4df45e3ff67e0e0d9d340d61060b9c74045b17efa5b1c1f5b05e

    Download Submit