e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
Size

468KB
MD5

211e2228612b79c62a477d8572c4986d
SHA1

97620f02ff6d7d34d334b31bc2fc066707e3d0b7
SHA256

e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153
SHA512

f7a5d3b61832e9a0095647e63f1dc75c51333403671787aae9dd86a7c63ba7c19cf82d819dc90cdd7a90879825f536f5cf42cbbaffdf164d6bc0435012c86d79
SSDEEP

6144:Ve34w12uoRlo2BFIJLNzOBS44lxytTsRRpTdwqQo5D8jCkjQC/EvK89E4O:IxpJLxOBS4uMKh+Wk98vKOVO

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
2432	211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\ButtonEvent.dll

Filesize
4KB

MD5
fad9d09fc0267e8513b8628e767b2604

SHA1
bea76a7621c07b30ed90bedef4d608a5b9e15300

SHA256
5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

SHA512
b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\CustomBrandingURL.dll

Filesize
5KB

MD5
e4c1b74859c17671ffe1c0602fd56b44

SHA1
15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1

SHA256
2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156

SHA512
9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\FloatingProgress.dll

Filesize
4KB

MD5
15bddd79574770cdbab1a9c13832d344

SHA1
dd63bf21db7049ba9773d0d06dbbb2d9b1ae914e

SHA256
5caf7bccc7fb43e43a50676a2466803cfb531f6416c6cb797750513770da6e18

SHA512
52f29c250a2426f43b67577ed5efe17992fa9ccb361cd1ad6ec19a60b02e2b7ee1c5a8131a29e37f84636d30916d6d2018ac769483861d1da3b0a1f4c91eb87b

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaBridge.dll

Filesize
8KB

MD5
60351c8bb166e71379f7268d25fba6d2

SHA1
e9ce69111b1a1c1f11cd99cc2cdff7c91b9096df

SHA256
0c0d9657ab06af5f556e944e333499dfde4fe119acb83cbed3d7744c9aac5b38

SHA512
42bdce0bfba2bf4b26e77fb33d6680fbbf43c891a4812ca873f621d822d3c93e0f25dd5cc3f31d0772494bcc0ca89ff93386847c0ffb87fab78f2de1d22df799

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaSocket\mime\core.dll

Filesize
52KB

MD5
4a4845ba1666907f708c9c10a31ec227

SHA1
1ebf626adc84147e5114885ce779f92d6eb68f3a

SHA256
a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d

SHA512
d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaSocket\socket\core.dll

Filesize
80KB

MD5
4bf7db111acfa7c28ad36606107b3322

SHA1
6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3

SHA256
bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0

SHA512
0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\LuaXml_lib.dll

Filesize
11KB

MD5
7292b642bd958aeb7fd7cfd19e45b068

SHA1
19a800620d041634abae5b5d096cb0e87ce4c188

SHA256
90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09

SHA512
bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\System.dll

Filesize
10KB

MD5
7e3c808299aa2c405dffa864471ddb7f

SHA1
b5de7804dd35ed7afd0c3b59d866f1a0749495e0

SHA256
91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd

SHA512
599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\customnsWeb.dll

Filesize
10KB

MD5
275de5977168e6db65cc85200df1ce6c

SHA1
7338140d51d89725f72532df5e1cc8dbed51a649

SHA256
05af47eaa56f8de9b63c7cb3626db4fb941236cf42014140898e5489023becdd

SHA512
d626c238af9caaffb19e6227fc744281f7b0644b0c6dc5e010f772bfaa285f84d6630c83d9abf03e4dd479e15370b8a058537985a72a958619eba49ee3337b8d

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\lua51.dll

Filesize
116KB

MD5
bbc9ac3211f07e45510861ae429996c3

SHA1
0a0d7ea99c959cd4add3deb05e500af5fdf98510

SHA256
2a4f510a75453fb49ceb2823756bdbcbfe1a026dcd27a76260229386776ddaad

SHA512
f3a4a726ffd7869d277e9ee09a833cc27e10f117c52dd2a2efcc96cf9280730f10dcb704ea78a6d6f16ac2d2db1b94ad6025dfabaf83fdaaca4f5fbb0db1e756

Download Submit
\Users\Admin\AppData\Local\Temp\nsi14C9.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/2432-48-0x0000000001EF0000-0x0000000001EFE000-memory.dmp

Filesize
56KB

Download
memory/2432-36-0x0000000001ED0000-0x0000000001EE6000-memory.dmp

Filesize
88KB

Download
memory/2432-101-0x0000000000530000-0x0000000000539000-memory.dmp

Filesize
36KB

Download