Overview
overview
7Static
static
36fffc035e5...18.exe
windows7-x64
76fffc035e5...18.exe
windows10-2004-x64
7$PLUGINSDI...on.dll
windows7-x64
1$PLUGINSDI...on.dll
windows10-2004-x64
1$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...id.dll
windows7-x64
3$PLUGINSDI...id.dll
windows10-2004-x64
3$R0.dll
windows7-x64
1$R0.dll
windows10-2004-x64
1$R2/NSIS.L...1_.exe
windows7-x64
1$R2/NSIS.L...1_.exe
windows10-2004-x64
1GPL.html
windows7-x64
1GPL.html
windows10-2004-x64
1filezilla.exe
windows7-x64
7filezilla.exe
windows10-2004-x64
7fzputtygen.exe
windows7-x64
1fzputtygen.exe
windows10-2004-x64
1fzsftp.exe
windows7-x64
1fzsftp.exe
windows10-2004-x64
1fzstorj.exe
windows7-x64
1fzstorj.exe
windows10-2004-x64
1Analysis
-
max time kernel
130s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:30
Static task
static1
Behavioral task
behavioral1
Sample
6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Fusion.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Fusion.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis_appid.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis_appid.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
$R0.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$R0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$R2/NSIS.Library.RegTool.v3.$_91_.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$R2/NSIS.Library.RegTool.v3.$_91_.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
GPL.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
GPL.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
filezilla.exe
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
filezilla.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
fzputtygen.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
fzputtygen.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
fzsftp.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
fzsftp.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
fzstorj.exe
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
fzstorj.exe
Resource
win10v2004-20240508-en
General
-
Target
6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe
-
Size
8.4MB
-
MD5
6fffc035e5d489d2c315c28429cb38ba
-
SHA1
898b17c401393b0d681d722ebd2e42e6ef536096
-
SHA256
4035c29e2effbbb4dfbb5827791653f70d17d8064a536081a87875a784eee013
-
SHA512
049faaefb6a759bb07c5a54c8838041b96394dbf4383d1997ca5ce20115cb96991d194f084b220c11ea7d74e4bcbd24843f7fbe73468e6dc230332bf956c731a
-
SSDEEP
196608:vc1MzQkLFwRRJSUxNGzwSqwK9ibqw/4VtC4Tj53XKNpDkYsY:v+MkxP8ONGz3r4VtpTJKNpDsY
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
Processes:
6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exepid process 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exepid process 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe 2804 6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsf3A1D.tmp\System.dllFilesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
C:\Users\Admin\AppData\Local\Temp\nsf3A1D.tmp\UAC.dllFilesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
C:\Users\Admin\AppData\Local\Temp\nsf3A1D.tmp\UserInfo.dllFilesize
4KB
MD51b446b36f5b4022d50ffdc0cf567b24a
SHA1d9a0a99fe5ea3932cbd2774af285ddf35fcdd4f9
SHA2562862c7bc7f11715cebdea003564a0d70bf42b73451e2b672110e1392ec392922
SHA51204ab80568f6da5eef2bae47056391a5de4ba6aff15cf4a2d0a9cc807816bf565161731921c65fe5ff748d2b86d1661f6aa4311c65992350bd63a9f092019f1b8