Overview
overview
7Static
static
37b1e2e3011...18.exe
windows7-x64
77b1e2e3011...18.exe
windows10-2004-x64
7$1/Tablacu...ff.exe
windows7-x64
1$1/Tablacu...ff.exe
windows10-2004-x64
1$3/$APPDAT...er.exe
windows7-x64
7$3/$APPDAT...er.exe
windows10-2004-x64
7$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$R1/Tablacus.exe
windows7-x64
4$R1/Tablacus.exe
windows10-2004-x64
3$R1/TablacusApp.exe
windows7-x64
1$R1/TablacusApp.exe
windows10-2004-x64
1$R1/script...und.js
windows7-x64
3$R1/script...und.js
windows10-2004-x64
3$R1/script/common.js
windows7-x64
3$R1/script/common.js
windows10-2004-x64
3$R1/script/consts.js
windows7-x64
3$R1/script/consts.js
windows10-2004-x64
3$R1/script...g.html
windows7-x64
1$R1/script...g.html
windows10-2004-x64
1$R1/script/index.html
windows7-x64
1$R1/script/index.html
windows10-2004-x64
1$R1/script/index.js
windows7-x64
3$R1/script/index.js
windows10-2004-x64
3$R1/script...n.html
windows7-x64
1$R1/script...n.html
windows10-2004-x64
1$R1/script...s.html
windows7-x64
1$R1/script...s.html
windows10-2004-x64
1$R1/script/options.js
windows7-x64
3$R1/script/options.js
windows10-2004-x64
3Analysis
-
max time kernel
135s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$1/TablacusInstallerStuff.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$1/TablacusInstallerStuff.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$3/$APPDATA/TablacusApp/uninstaller.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$3/$APPDATA/TablacusApp/uninstaller.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$R1/Tablacus.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
$R1/Tablacus.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$R1/TablacusApp.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$R1/TablacusApp.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$R1/script/background.js
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$R1/script/background.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$R1/script/common.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$R1/script/common.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$R1/script/consts.js
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
$R1/script/consts.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$R1/script/dialog.html
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
$R1/script/dialog.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
$R1/script/index.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$R1/script/index.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
$R1/script/index.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
$R1/script/index.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
$R1/script/location.html
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
$R1/script/location.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
$R1/script/options.html
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
$R1/script/options.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
$R1/script/options.js
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$R1/script/options.js
Resource
win10v2004-20240226-en
General
-
Target
7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe
-
Size
465KB
-
MD5
7b1e2e30115fdd17e80825bcb58216cf
-
SHA1
f32bf80a09a0f4c7fcbfedb813c475f83658a665
-
SHA256
544dd232f4eb70fbfd04ebe99ec1e69d5813df06dcb8d56f5058a6d6d6d17da8
-
SHA512
2db93265c4d69abc839e23bad127722caa6c5b288aab34a5237f2e106b045b28b0773960077d041bf64521a2fba221c29b35108fe080a1f6585b9738fe5c6406
-
SSDEEP
12288:eeVz7cNqOQ/3AjTr7vHSujL6TciSgUvsG:dVz7cN0/3YrziT5HG
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1512 TablacusInstallerStuff.exe 764 TablacusApp.exe -
Loads dropped DLL 1 IoCs
pid Process 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TablacusApp2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\TablacusApp\\TablacusApp.exe\"" TablacusApp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1512 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 83 PID 4864 wrote to memory of 1512 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 83 PID 4864 wrote to memory of 1512 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 83 PID 4864 wrote to memory of 764 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 87 PID 4864 wrote to memory of 764 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 87 PID 4864 wrote to memory of 764 4864 7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\nsu45A5.tmp\TablacusInstallerStuff.exe"C:\Users\Admin\AppData\Local\Temp\nsu45A5.tmp\TablacusInstallerStuff.exe" "write_patch_str_to_reg" "C:\Users\Admin\AppData\Local\Temp\7b1e2e30115fdd17e80825bcb58216cf_JaffaCakes118.exe" "HKCU" "Software\TablacusApp" "badumt"2⤵
- Executes dropped EXE
PID:1512
-
-
C:\Users\Admin\AppData\Roaming\TablacusApp\TablacusApp.exeC:\Users\Admin\AppData\Roaming\TablacusApp\TablacusApp.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD58a8ecd5494501a649b5e0bf1c6c9d64b
SHA1a8decedb5dd8964e6d754c8cc1f5fa6a6a1ba591
SHA256c577eaec822a6fd6c29a22cc1e19d63d4b99da26145be5c472536d2054347113
SHA5122a4dd8d15afcccc3b0a658dfcb763e6e2a8e94f47a538cd60309e6b771e598ab129d2d35a87c2ce1f3ecfdd0d61a82b2853e978b91714269814cc9543993cd3c
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
211KB
MD5e2bc6cb52f9e0b2deb712a962f0251e7
SHA1fc2318e70bc05f36176fbc542aa881277ea03b81
SHA2561dcc2b1788681bbb0f0838d2ac5b6b57b2e58cad5cd925a8af6d8348c1bbc34b
SHA512a6e809736fda2956f6a078d7c7c02d7eceefdf1630693937e79ea665ca4e9746e299ca3e1fd7268cbab07248275b13fe694f633f2b96eb68baa136a0fccd1ae5