Overview

overview

7

Static

static

3

211e222861...18.exe

windows7-x64

7

211e222861...18.exe

windows10-2004-x64

7

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...tc.dll

windows7-x64

3

$PLUGINSDI...tc.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

1

$PLUGINSDI...ss.dll

windows10-2004-x64

1

$PLUGINSDI...ge.dll

windows7-x64

3

$PLUGINSDI...ge.dll

windows10-2004-x64

3

$PLUGINSDI...n12.js

windows7-x64

3

$PLUGINSDI...n12.js

windows10-2004-x64

3

$PLUGINSDI...ime.js

windows7-x64

3

$PLUGINSDI...ime.js

windows10-2004-x64

3

$PLUGINSDI...ket.js

windows7-x64

3

$PLUGINSDI...ket.js

windows10-2004-x64

3

$PLUGINSDI...ftp.js

windows7-x64

3

$PLUGINSDI...ftp.js

windows10-2004-x64

3

$PLUGINSDI...ttp.js

windows7-x64

3

$PLUGINSDI...ttp.js

windows10-2004-x64

3

$PLUGINSDI.../tp.js

windows7-x64

3

$PLUGINSDI.../tp.js

windows10-2004-x64

3

$PLUGINSDI...re.dll

windows7-x64

1

$PLUGINSDI...re.dll

windows10-2004-x64

1

$PLUGINSDI...re.dll

windows7-x64

1

$PLUGINSDI...re.dll

windows10-2004-x64

1

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
  • Size 468KB
  • Sample240703-feecpasbmr
  • SHA256 e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\211e2228612b79c62a477d8572c4986d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2520

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ButtonEvent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\ButtonEvent.dll
        • Size 4KB
        • SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
        • MD5 SHA1 SHA512
        Submit Download

        CustomBrandingURL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\CustomBrandingURL.dll
        • Size 5KB
        • SHA256 2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FloatingProgress.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\FloatingProgress.dll
        • Size 4KB
        • SHA256 5caf7bccc7fb43e43a50676a2466803cfb531f6416c6cb797750513770da6e18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LuaBridge.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\LuaBridge.dll
        • Size 8KB
        • SHA256 0c0d9657ab06af5f556e944e333499dfde4fe119acb83cbed3d7744c9aac5b38
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\LuaSocket\mime\core.dll
        • Size 52KB
        • SHA256 a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\LuaSocket\socket\core.dll
        • Size 80KB
        • SHA256 bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LuaXml_lib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\LuaXml_lib.dll
        • Size 11KB
        • SHA256 90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\System.dll
        • Size 10KB
        • SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        customnsWeb.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\customnsWeb.dll
        • Size 10KB
        • SHA256 05af47eaa56f8de9b63c7cb3626db4fb941236cf42014140898e5489023becdd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lua51.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\lua51.dll
        • Size 116KB
        • SHA256 2a4f510a75453fb49ceb2823756bdbcbfe1a026dcd27a76260229386776ddaad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd423A.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2520-57-0x0000000002890000-0x000000000289E000-memory.dmp
        Download

        memory/2520-62-0x0000000002840000-0x0000000002849000-memory.dmp
        Download

        memory/2520-42-0x0000000002850000-0x0000000002866000-memory.dmp
        Download