Overview
overview
7Static
static
36fffc035e5...18.exe
windows7-x64
76fffc035e5...18.exe
windows10-2004-x64
7$PLUGINSDI...on.dll
windows7-x64
1$PLUGINSDI...on.dll
windows10-2004-x64
1$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...id.dll
windows7-x64
3$PLUGINSDI...id.dll
windows10-2004-x64
3$R0.dll
windows7-x64
1$R0.dll
windows10-2004-x64
1$R2/NSIS.L...1_.exe
windows7-x64
1$R2/NSIS.L...1_.exe
windows10-2004-x64
1GPL.html
windows7-x64
1GPL.html
windows10-2004-x64
1filezilla.exe
windows7-x64
7filezilla.exe
windows10-2004-x64
7fzputtygen.exe
windows7-x64
1fzputtygen.exe
windows10-2004-x64
1fzsftp.exe
windows7-x64
1fzsftp.exe
windows10-2004-x64
1fzstorj.exe
windows7-x64
1fzstorj.exe
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:30
Static task
static1
Behavioral task
behavioral1
Sample
6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6fffc035e5d489d2c315c28429cb38ba_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Fusion.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Fusion.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis_appid.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis_appid.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
$R0.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$R0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$R2/NSIS.Library.RegTool.v3.$_91_.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$R2/NSIS.Library.RegTool.v3.$_91_.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
GPL.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
GPL.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
filezilla.exe
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
filezilla.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
fzputtygen.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
fzputtygen.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
fzsftp.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
fzsftp.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
fzstorj.exe
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
fzstorj.exe
Resource
win10v2004-20240508-en
General
-
Target
filezilla.exe
-
Size
9.9MB
-
MD5
2ac628e3fad3f0166d6776bf2c4ee09e
-
SHA1
1ebde423161f049985c09f8d8b694178f62441f3
-
SHA256
1aaf40ef07451bafdae8a143ec605413f4c1bbef48ff2fd06d7f5250633f7030
-
SHA512
27e9037738c58c15125375bab675e1fc73655d768e559ec8a811f96cc0f0a670c90793b16aa3d5a5f9ba3962c546341083e64a133fe9b27aa715e0d27ab34014
-
SSDEEP
98304:f3hRMz7WCKb2lWLgqIRkQOf88G87oycbzt1bnX+ri2GB/44+4U:fAzY2Uc9TLNz/nXWi2M4P4U
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
filezilla.exepid process 4724 filezilla.exe 4724 filezilla.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4724-40-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB
-
memory/4724-49-0x000000006FFD0000-0x000000007005D000-memory.dmpFilesize
564KB
-
memory/4724-48-0x0000000070060000-0x00000000701BA000-memory.dmpFilesize
1.4MB
-
memory/4724-47-0x00000000701C0000-0x00000000701E6000-memory.dmpFilesize
152KB
-
memory/4724-46-0x00000000701F0000-0x000000007020B000-memory.dmpFilesize
108KB
-
memory/4724-45-0x0000000070210000-0x000000007035C000-memory.dmpFilesize
1.3MB
-
memory/4724-44-0x0000000070360000-0x000000007039E000-memory.dmpFilesize
248KB
-
memory/4724-43-0x00000000703A0000-0x00000000703DD000-memory.dmpFilesize
244KB
-
memory/4724-42-0x00000000703E0000-0x000000007041A000-memory.dmpFilesize
232KB
-
memory/4724-41-0x0000000070420000-0x0000000070454000-memory.dmpFilesize
208KB
-
memory/4724-51-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB
-
memory/4724-61-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB
-
memory/4724-71-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB
-
memory/4724-81-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB
-
memory/4724-91-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB