e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
Size 468KB
Sample240703-feecpasbmr
SHA256 e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153
MD5 211e2228612b79c62a477d8572c4986d
SHA1 97620f02ff6d7d34d334b31bc2fc066707e3d0b7
SHA512 f7a5d3b61832e9a0095647e63f1dc75c51333403671787aae9dd86a7c63ba7c19cf82d819dc90cdd7a90879825f536f5cf42cbbaffdf164d6bc0435012c86d79
SSDEEP 6144:Ve34w12uoRlo2BFIJLNzOBS44lxytTsRRpTdwqQo5D8jCkjQC/EvK89E4O:IxpJLxOBS4uMKh+Wk98vKOVO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ButtonEvent.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\ButtonEvent.dll
Size 4KB
SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
MD5 fad9d09fc0267e8513b8628e767b2604
SHA1 bea76a7621c07b30ed90bedef4d608a5b9e15300
SHA512 b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
MD5 SHA1 SHA512

Submit Download

CustomBrandingURL.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\CustomBrandingURL.dll
Size 5KB
SHA256 2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
MD5 e4c1b74859c17671ffe1c0602fd56b44
SHA1 15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1
SHA512 9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925
SSDEEP 48:SMq1qEwUNRYDeKPTeKp4GN8C8hgIV2f4ag5pmy8WywlhQ7sp9CSC2bH:hq1q/QPKSKp4m80i2QGpvwLXLCtGH
MD5 SHA1 SHA512 SSDEEP

Submit Download

FloatingProgress.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\FloatingProgress.dll
Size 4KB
SHA256 5caf7bccc7fb43e43a50676a2466803cfb531f6416c6cb797750513770da6e18
MD5 15bddd79574770cdbab1a9c13832d344
SHA1 dd63bf21db7049ba9773d0d06dbbb2d9b1ae914e
SHA512 52f29c250a2426f43b67577ed5efe17992fa9ccb361cd1ad6ec19a60b02e2b7ee1c5a8131a29e37f84636d30916d6d2018ac769483861d1da3b0a1f4c91eb87b
SSDEEP 48:SBn9+qyt9ofRgODb/ZfKVT60l/5Lh4VzQqO3rwBRbN5:g2k+O3/PIhIc10BJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

LuaBridge.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaBridge.dll
Size 8KB
SHA256 0c0d9657ab06af5f556e944e333499dfde4fe119acb83cbed3d7744c9aac5b38
MD5 60351c8bb166e71379f7268d25fba6d2
SHA1 e9ce69111b1a1c1f11cd99cc2cdff7c91b9096df
SHA512 42bdce0bfba2bf4b26e77fb33d6680fbbf43c891a4812ca873f621d822d3c93e0f25dd5cc3f31d0772494bcc0ca89ff93386847c0ffb87fab78f2de1d22df799
SSDEEP 192:ygwF1EUW6DchFSe5z9teSNKBWaeVzQ38WDOOW:ondW64bSqhfK1gQMWDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaSocket\mime\core.dll
Size 52KB
SHA256 a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
MD5 4a4845ba1666907f708c9c10a31ec227
SHA1 1ebf626adc84147e5114885ce779f92d6eb68f3a
SHA512 d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
SSDEEP 768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaSocket\socket\core.dll
Size 80KB
SHA256 bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
MD5 4bf7db111acfa7c28ad36606107b3322
SHA1 6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA512 0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
SSDEEP 768:4pOz0XSP1hSt5+5lKfZyDy3TygCk749NRAa1YwqJlfp8iB9jDEu/s5RPOothtlRp:wOws14t5CeTygmNRA0IVh05IoN3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LuaXml_lib.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaXml_lib.dll
Size 11KB
SHA256 90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
MD5 7292b642bd958aeb7fd7cfd19e45b068
SHA1 19a800620d041634abae5b5d096cb0e87ce4c188
SHA512 bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
SSDEEP 192:YK/pDHjlL5Fv4k0CSigGpV8pVqVyoyhXnX1:N/L5FqCjpV8pVswXnX
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\System.dll
Size 10KB
SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
MD5 7e3c808299aa2c405dffa864471ddb7f
SHA1 b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA512 599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
SSDEEP 192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

customnsWeb.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\customnsWeb.dll
Size 10KB
SHA256 05af47eaa56f8de9b63c7cb3626db4fb941236cf42014140898e5489023becdd
MD5 275de5977168e6db65cc85200df1ce6c
SHA1 7338140d51d89725f72532df5e1cc8dbed51a649
SHA512 d626c238af9caaffb19e6227fc744281f7b0644b0c6dc5e010f772bfaa285f84d6630c83d9abf03e4dd479e15370b8a058537985a72a958619eba49ee3337b8d
SSDEEP 192:KD3gNufdrGB7S0OOly/HlUQb2/xO0ryVnnPhj:KcwfIB7S0Dk/HQtryVnnPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

lua51.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\lua51.dll
Size 116KB
SHA256 2a4f510a75453fb49ceb2823756bdbcbfe1a026dcd27a76260229386776ddaad
MD5 bbc9ac3211f07e45510861ae429996c3
SHA1 0a0d7ea99c959cd4add3deb05e500af5fdf98510
SHA512 f3a4a726ffd7869d277e9ee09a833cc27e10f117c52dd2a2efcc96cf9280730f10dcb704ea78a6d6f16ac2d2db1b94ad6025dfabaf83fdaaca4f5fbb0db1e756
SSDEEP 3072:+RyHKGrwG4F9FBtzYyEqRi/0L/AZ4g3qq:+RGXrHOHAYi/7L3q
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path \Users\Admin\AppData\Local\Temp\nsi14C9.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2432-48-0x0000000001EF0000-0x0000000001EFE000-memory.dmp

Download

memory/2432-36-0x0000000001ED0000-0x0000000001EE6000-memory.dmp

Download

memory/2432-101-0x0000000000530000-0x0000000000539000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads