Overview

overview

7

Static

static

3

4e6875dca7...18.exe

windows7-x64

7

4e6875dca7...18.exe

windows10-2004-x64

7

$PLUGINSDI...am.dll

windows7-x64

3

$PLUGINSDI...am.dll

windows10-2004-x64

3

$PLUGINSDI...08.dll

windows7-x64

3

$PLUGINSDI...08.dll

windows10-2004-x64

3

$PLUGINSDI...g2.dll

windows7-x64

3

$PLUGINSDI...g2.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

DTCommonRes.dll

windows7-x64

3

DTCommonRes.dll

windows10-2004-x64

3

DTGadget32.dll

windows7-x64

1

DTGadget32.dll

windows10-2004-x64

1

DTGadget64.dll

windows7-x64

7

DTGadget64.dll

windows10-2004-x64

7

DTHelper.exe

windows7-x64

1

DTHelper.exe

windows10-2004-x64

1

gadget.html

windows7-x64

1

gadget.html

windows10-2004-x64

1

jquery/jquery.min.js

windows7-x64

3

jquery/jquery.min.js

windows10-2004-x64

3

jquery/new...ons.js

windows7-x64

3

jquery/new...ons.js

windows10-2004-x64

3

jquery/newgadget.js

windows7-x64

3

jquery/newgadget.js

windows10-2004-x64

3

message.html

windows7-x64

1

message.html

windows10-2004-x64

1

Analysis

  • max time kernel
    139s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 04:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4e6875dca7cd0e0f0adf0b442d154e54_JaffaCakes118.exe
  • Size 14.8MB
  • Sample240517-ezzcxshc96
  • SHA256 ad639bb9d966273c305fc59b2f2a661cfb77944cd4aa0c83e3333c65cc13a510
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e6875dca7cd0e0f0adf0b442d154e54_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4e6875dca7cd0e0f0adf0b442d154e54_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3984
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4612

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DLLWaitForKillProgram.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\DLLWaitForKillProgram.dll
          • Size 28KB
          • SHA256 ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Dialer.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\Dialer.dll
          • Size 3KB
          • SHA256 c384decad4baf8c3f1dbe0e02bc7b76f11e5793ccc164b6857d8fe9eb5a9903a
          • MD5 SHA1 SHA512
          Submit Download

          FILEDownPlug2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\FILEDownPlug2.dll
          • Size 28KB
          • SHA256 8bd1c61e9be2b8b07f6dac4782a96ee9e679c5f163133a51b57e1ecd72f3eff9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          InstallOptions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\InstallOptions.dll
          • Size 14KB
          • SHA256 1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          KillProcDLL.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\KillProcDLL.dll
          • Size 4KB
          • SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
          • MD5 SHA1 SHA512
          Submit Download

          SimpleSC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\SimpleSC.dll
          • Size 61KB
          • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\System.dll
          • Size 11KB
          • SHA256 4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\ioSpecial.ini
          • Size 666B
          • SHA256 ad520fe61b77ae6d01a088bbba19a4f68d56a4817e79cc09f956b836f5c715dc
          • MD5 SHA1 SHA512
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsz29FA.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
          • MD5 SHA1 SHA512
          Submit Download

          memory/3984-5-0x00000000022C0000-0x00000000022D3000-memory.dmp
          Download

          memory/3984-13-0x0000000010000000-0x0000000010003000-memory.dmp
          Download