Overview
overview
10Static
static
107199ac1b49...18.exe
windows7-x64
77199ac1b49...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3PBWS32.dll
windows7-x64
1PBWS32.dll
windows10-2004-x64
1baro.exe
windows7-x64
1baro.exe
windows10-2004-x64
1dll/FreeImage.dll
windows7-x64
3dll/FreeImage.dll
windows10-2004-x64
3dll/Interop.WIA.dll
windows7-x64
1dll/Interop.WIA.dll
windows10-2004-x64
1dll/Markup...er.dll
windows7-x64
1dll/Markup...er.dll
windows10-2004-x64
1dll/PdfSharp.dll
windows7-x64
1dll/PdfSharp.dll
windows10-2004-x64
1dll/RegAsm.exe
windows7-x64
1dll/RegAsm.exe
windows10-2004-x64
1dll/SDD_TW...ER.dll
windows7-x64
1dll/SDD_TW...ER.dll
windows10-2004-x64
1dll/Saraff.Twain.dll
windows7-x64
1dll/Saraff.Twain.dll
windows10-2004-x64
1dll/System...ng.dll
windows7-x64
1dll/System...ng.dll
windows10-2004-x64
1dll/UzakYardim.exe
windows7-x64
10dll/UzakYardim.exe
windows10-2004-x64
10dll/WinSCP.exe
windows7-x64
6dll/WinSCP.exe
windows10-2004-x64
7Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 10:05
Behavioral task
behavioral1
Sample
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
PBWS32.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
PBWS32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
baro.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
baro.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
dll/FreeImage.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
dll/FreeImage.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
dll/Interop.WIA.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
dll/Interop.WIA.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
dll/MarkupConverter.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
dll/MarkupConverter.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
dll/PdfSharp.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
dll/PdfSharp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
dll/RegAsm.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
dll/RegAsm.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
dll/SDD_TWAIN_SCANNER.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
dll/SDD_TWAIN_SCANNER.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
dll/Saraff.Twain.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
dll/Saraff.Twain.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
dll/System.Drawing.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
dll/System.Drawing.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
dll/UzakYardim.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
dll/UzakYardim.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
dll/WinSCP.exe
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
dll/WinSCP.exe
Resource
win10v2004-20240508-en
General
-
Target
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
-
Size
23.2MB
-
MD5
7199ac1b490ee536471c6c613fd9a170
-
SHA1
7004cff9c2143ad1af170adbd43f5977b8c4872a
-
SHA256
a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649
-
SHA512
4ebc3fd9648f91acbec0272d9cdb393b6d988c4441ebb60a0d9b7430b268f826f730ed1e0094b28dc68eeec56a8570c64ab8fbc40485fd50e476f73e22fb9b18
-
SSDEEP
393216:9rX2hFm5Aes/9wDDyMTtOSufUD+Lk0QRQAm5EUymJONvTo3ofrzRUt3f9SNu8q8d:9b2EAwjtOjfM0QHmNXi8YTzRfNxTd
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exepid process 2756 7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe 2756 7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe 2756 7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exepid process 2756 7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
831B
MD530466ccdc68836a6ca8435c9fc1f341c
SHA1ebd42195f42e6365543f62e409f7e01d4d6b1650
SHA2567be9f48130305a3231ecfa8c6159f4145ca4a808945f013c62613f0e05aa6b45
SHA5125c050262cc00e252714b1884eba8af8a44943c66cbf822787e7e0017fa4dfaf1ff3dd692a20855f9e7bbfbecf91be8cee389a948401c28f8dacf2c1ee5ae0308
-
Filesize
14KB
MD520f3184efe7edddfef3325efc25d12a5
SHA18db4c500d73f9525a7e9834df6caea2e70189939
SHA2560e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a
SHA512433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a
-
Filesize
5KB
MD5ea60c7bd5edd6048601729bd31362c16
SHA16e6919d969eb61a141595014395b6c3f44139073
SHA2564e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39
SHA512f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993
-
Filesize
5KB
MD5669030d7919ae29999a2fd89aa427202
SHA1870bcb7e87bbf423abcbc1c5be80f7e63720a6d8
SHA256e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82
SHA5121637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f