Overview
overview
10Static
static
10b748e68c3b...18.exe
windows7-x64
7b748e68c3b...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3DMCustomControls.dll
windows7-x64
1DMCustomControls.dll
windows10-2004-x64
1DMSharedClasses.dll
windows7-x64
1DMSharedClasses.dll
windows10-2004-x64
1DMStartupW...rs.dll
windows7-x64
1DMStartupW...rs.dll
windows10-2004-x64
1DMStartupWizard.dll
windows7-x64
1DMStartupWizard.dll
windows10-2004-x64
1DMUpdater.exe
windows7-x64
1DMUpdater.exe
windows10-2004-x64
1DataMaster...er.exe
windows7-x64
1DataMaster...er.exe
windows10-2004-x64
1DataMaster...rs.dll
windows7-x64
1DataMaster...rs.dll
windows10-2004-x64
1DataMaster...LS.exe
windows7-x64
1DataMaster...LS.exe
windows10-2004-x64
1DataMaster...er.exe
windows7-x64
1DataMaster...er.exe
windows10-2004-x64
1DataMasterDDE.exe
windows7-x64
1DataMasterDDE.exe
windows10-2004-x64
1DataMaster...rs.dll
windows7-x64
1DataMaster...rs.dll
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 06:53
Behavioral task
behavioral1
Sample
b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
DMCustomControls.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
DMCustomControls.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
DMSharedClasses.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
DMSharedClasses.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
DMStartupWizard.XmlSerializers.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
DMStartupWizard.XmlSerializers.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
DMStartupWizard.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
DMStartupWizard.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
DMUpdater.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
DMUpdater.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
DataMaster Launcher.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
DataMaster Launcher.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
DataMaster MAARMLS.XmlSerializers.dll
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
DataMaster MAARMLS.XmlSerializers.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
DataMaster MAARMLS.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
DataMaster MAARMLS.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
DataMasterAssociater.exe
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
DataMasterAssociater.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
DataMasterDDE.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
DataMasterDDE.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
DataMasterPlus.XmlSerializers.dll
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
DataMasterPlus.XmlSerializers.dll
Resource
win10v2004-20240611-en
General
-
Target
b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe
-
Size
3.0MB
-
MD5
b748e68c3b132a964735e64fdcdab877
-
SHA1
9e6e18b4368d91cbf60af4b7ab7ecb7b3d0354a5
-
SHA256
76238af88d9a95bd3c17b150465d6dc8f0734d9b25670d8bd10d63559a55b615
-
SHA512
9ddd0fd7ad0395af9147f4bec255aedb32fbfbeb9be5a9cf2952c30f9a39db46a96ea194d4166742fd942a076a1b014418b6a66c0d8ee2f1171128827fa6194b
-
SSDEEP
49152:sTKVqrkZt9zHRK8wHGkNmL8MzYjNJSszKUqGDbc1oODEydI+YdYl8gt:sTKVqY/9zxXwHGQmL8LSUK/p7EydI3aT
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2052 b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe 2052 b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2052 b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2052 b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5cc0bd4f5a79107633084471dbd4af796
SHA109dfcf182b1493161dec8044a5234c35ee24c43a
SHA2563b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
SHA51267ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
-
Filesize
745B
MD55162b9b305ff1db79cbd6026f851a6f2
SHA1ea7abaecda1d8a7b9e156650b07e12ee26657188
SHA256d76a1a933119c9807496f4f7c4e6f565ac20869c59c0bc22e497fb6586da40e9
SHA512cd2f6063d1b99b78a2b14d15fbf50f738886cc4eabdad622efd86101bcd8f24410ce88bee43b7792fd1a62f038dce7618fcc0f977cdcca0cf27b18b36b26fc7a
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf