Overview
overview
7Static
static
310343bf892...18.exe
windows7-x64
710343bf892...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3AxsUtils.dll
windows7-x64
1AxsUtils.dll
windows10-2004-x64
1CheckForUpdates.dll
windows7-x64
1CheckForUpdates.dll
windows10-2004-x64
1Interop.eW...ol.dll
windows7-x64
1Interop.eW...ol.dll
windows10-2004-x64
1LLCryptoLib.dll
windows7-x64
1LLCryptoLib.dll
windows10-2004-x64
1LiteActivate.dll
windows7-x64
1LiteActivate.dll
windows10-2004-x64
1LiteErrorReport.dll
windows7-x64
1LiteErrorReport.dll
windows10-2004-x64
1LiteSerializer.dll
windows7-x64
1LiteSerializer.dll
windows10-2004-x64
1Microsoft....el.dll
windows7-x64
1Microsoft....el.dll
windows10-2004-x64
1Microsoft....op.dll
windows7-x64
1Microsoft....op.dll
windows10-2004-x64
1NCryptXL.exe
windows7-x64
1NCryptXL.exe
windows10-2004-x64
1data/examp...le.xls
windows7-x64
1data/examp...le.xls
windows10-2004-x64
1data/examp...s.xlsx
windows7-x64
1data/examp...s.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
130s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
AxsUtils.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
AxsUtils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
CheckForUpdates.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
CheckForUpdates.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Interop.eWebControl.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
Interop.eWebControl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
LLCryptoLib.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
LLCryptoLib.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
LiteActivate.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
LiteActivate.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
LiteErrorReport.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
LiteErrorReport.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
LiteSerializer.dll
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
LiteSerializer.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Microsoft.Office.Interop.Excel.dll
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
Microsoft.Office.Interop.Excel.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Microsoft.Vbe.Interop.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Microsoft.Vbe.Interop.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
NCryptXL.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
NCryptXL.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
data/examples/Example.xls
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
data/examples/Example.xls
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
data/examples/RandomPasswords.xlsx
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
data/examples/RandomPasswords.xlsx
Resource
win10v2004-20240508-en
General
-
Target
10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
10343bf892632ec266a3cc135e68a848
-
SHA1
c4556986757e6aa60e40b04ef4078339ffaed4e6
-
SHA256
989b7036f1b50befeb7da1c6d1af00624e34c101c91a83e2e746a7f0ef484f29
-
SHA512
2807e3dc84495b4bcb2cf18646775d61a81f641a3efedcc8e1bdda5ca55aaa14b29c492ace8c8118fc76f293c8434dcb9d0fe97aacda8da98fc68e4f5742e43e
-
SSDEEP
24576:WlJPwvWtNp1jShEEtjIXr3f/BHW0lM35N8D8PLgcgh882I5PVavd26:IPwuj7ShEEtM7vp2aD2gVGs5Pkvd1
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 5068 10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe 5068 10343bf892632ec266a3cc135e68a848_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5d7b3f05ff44116b9080b5e69b2e86efd
SHA12535ecfa122041edb901ac667944e0f6814c4cd0
SHA25640d66e085409445202dce1b5419449cc302d91be17614b521e3ccce473205db7
SHA512414c6b410b35a8bb5a2c9fdd46dad63704484e1535155219b29a5bb886ded73f4b7ca3bafa726ce751e1c711a764938c9256106a90098263d6ff88bc017ec140
-
Filesize
10KB
MD54fbb4a2cd711fc1fe84f3dc30c491dc9
SHA1888e01ae6e64e7326f88df9a30587f699eab154a
SHA256c3b05f4faf5e8903d5b4cb4a8ce4bbf2e8144725b98d8787d51c117b6efa9bc2
SHA51292dcf99672a5935065df6492e27abb653679f1db6dcddfde87cd14260c94a870327826b23cc2f338381b3eb53d07c1a3867806f6ff94533db5195b895a856847
-
Filesize
752B
MD57f7508202727b95a07f2d4283d3086ae
SHA1e21824a97875af680c4faba53887daec337a2bb0
SHA256e5cf816c1d44137104f5e34e1b7feb50ff26a2e377da7b9e90da7c9588401f7e
SHA51209dde4bd3c4821c4561ec59de1da4724788f53a55cd7dd6b8b832b27bd1a54a0ad419aca5df52d25282a9e68fb73e7cf587c0e2eb4b3bc0e97e659662e33f840
-
Filesize
765B
MD5d11025a92ca230380c61169563f7cf50
SHA1c036d8cc827047d49bca08734c5bb89f8475a716
SHA256f5cb6bff99c894499024e9fed0b59bea791ebed26ce22fd0cfe3e3b5e793ac04
SHA51291a0d7fe86284713d900a9958aa4067712feefe8f37e52de501f184d3976c4ceaf2e78547e32fde021943b46341491591047f86f9281257bc3cbfb798cb63417