Overview
overview
7Static
static
310343bf892...18.exe
windows7-x64
710343bf892...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3AxsUtils.dll
windows7-x64
1AxsUtils.dll
windows10-2004-x64
1CheckForUpdates.dll
windows7-x64
1CheckForUpdates.dll
windows10-2004-x64
1Interop.eW...ol.dll
windows7-x64
1Interop.eW...ol.dll
windows10-2004-x64
1LLCryptoLib.dll
windows7-x64
1LLCryptoLib.dll
windows10-2004-x64
1LiteActivate.dll
windows7-x64
1LiteActivate.dll
windows10-2004-x64
1LiteErrorReport.dll
windows7-x64
1LiteErrorReport.dll
windows10-2004-x64
1LiteSerializer.dll
windows7-x64
1LiteSerializer.dll
windows10-2004-x64
1Microsoft....el.dll
windows7-x64
1Microsoft....el.dll
windows10-2004-x64
1Microsoft....op.dll
windows7-x64
1Microsoft....op.dll
windows10-2004-x64
1NCryptXL.exe
windows7-x64
1NCryptXL.exe
windows10-2004-x64
1data/examp...le.xls
windows7-x64
1data/examp...le.xls
windows10-2004-x64
1data/examp...s.xlsx
windows7-x64
1data/examp...s.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
26/06/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
AxsUtils.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
AxsUtils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
CheckForUpdates.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
CheckForUpdates.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Interop.eWebControl.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
Interop.eWebControl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
LLCryptoLib.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
LLCryptoLib.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
LiteActivate.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
LiteActivate.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
LiteErrorReport.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
LiteErrorReport.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
LiteSerializer.dll
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
LiteSerializer.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Microsoft.Office.Interop.Excel.dll
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
Microsoft.Office.Interop.Excel.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Microsoft.Vbe.Interop.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Microsoft.Vbe.Interop.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
NCryptXL.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
NCryptXL.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
data/examples/Example.xls
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
data/examples/Example.xls
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
data/examples/RandomPasswords.xlsx
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
data/examples/RandomPasswords.xlsx
Resource
win10v2004-20240508-en
General
-
Target
10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
10343bf892632ec266a3cc135e68a848
-
SHA1
c4556986757e6aa60e40b04ef4078339ffaed4e6
-
SHA256
989b7036f1b50befeb7da1c6d1af00624e34c101c91a83e2e746a7f0ef484f29
-
SHA512
2807e3dc84495b4bcb2cf18646775d61a81f641a3efedcc8e1bdda5ca55aaa14b29c492ace8c8118fc76f293c8434dcb9d0fe97aacda8da98fc68e4f5742e43e
-
SSDEEP
24576:WlJPwvWtNp1jShEEtjIXr3f/BHW0lM35N8D8PLgcgh882I5PVavd26:IPwuj7ShEEtM7vp2aD2gVGs5Pkvd1
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1876 10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe 1876 10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1876 10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
752B
MD5229337e2ccc7a13a8b26f6f34ea143a5
SHA1beead2002f3ad0bd288a37a3f0ad107fb5edf29e
SHA25625c48af3fb238be3ab1ea96b03858436b1006f4a27a7c12df45703363d0dc3a1
SHA5128d7c16025ff37940dc1b148e81f9d68cf2575087bfb2a6f82affbed19e49fbbeb89a33894c5d6074ed906362d7acfeae1f459958be2c1832655e4400da003cb1
-
Filesize
14KB
MD5d7b3f05ff44116b9080b5e69b2e86efd
SHA12535ecfa122041edb901ac667944e0f6814c4cd0
SHA25640d66e085409445202dce1b5419449cc302d91be17614b521e3ccce473205db7
SHA512414c6b410b35a8bb5a2c9fdd46dad63704484e1535155219b29a5bb886ded73f4b7ca3bafa726ce751e1c711a764938c9256106a90098263d6ff88bc017ec140
-
Filesize
10KB
MD54fbb4a2cd711fc1fe84f3dc30c491dc9
SHA1888e01ae6e64e7326f88df9a30587f699eab154a
SHA256c3b05f4faf5e8903d5b4cb4a8ce4bbf2e8144725b98d8787d51c117b6efa9bc2
SHA51292dcf99672a5935065df6492e27abb653679f1db6dcddfde87cd14260c94a870327826b23cc2f338381b3eb53d07c1a3867806f6ff94533db5195b895a856847