Overview
overview
7Static
static
3620d3da55b...18.exe
windows7-x64
7620d3da55b...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...cc.exe
windows7-x64
3$PLUGINSDI...cc.exe
windows10-2004-x64
3$PLUGINSDI...ok.dll
windows7-x64
1$PLUGINSDI...ok.dll
windows10-2004-x64
1$PLUGINSDI...ll.bat
windows7-x64
6$PLUGINSDI...ll.bat
windows10-2004-x64
6Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 00:30
Static task
static1
Behavioral task
behavioral1
Sample
620d3da55be8cce610cccb366fd10232_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
620d3da55be8cce610cccb366fd10232_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/apple-scc.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/apple-scc.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nstvhook.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nstvhook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/uninstall.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/uninstall.bat
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/apple-scc.exe
-
Size
894KB
-
MD5
9063d36084fbe906558c507409a71377
-
SHA1
4ba56ab05ed64d5e447e93d05544680d31ff1a6b
-
SHA256
bcdbcadc5b2b21a64a0f9caa3413745c7ed4d137d3bb0cd79526368ecc7f214d
-
SHA512
c3c211bd4867efd66243194b3e9514a34c197e527a83e6384a88ceaa54d1547f37713fef8180c4b0fcc23f9bb81208de905525eb107b38a5619ce88aa86d2394
-
SSDEEP
24576:M4QLWUfv+QjsSjgfrWlWWSCFgtx4/OJmn5gHv3Ry3NT2ZP0ro4kT42:M7dGEEjWV3cx4/u+gHv3m2ZL4f2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2172 apple-scc.exe 2172 apple-scc.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD52ee735d83d51cadaf54afa54668330c9
SHA17c6a6421a213af6106c21b60e05b86c05662c066
SHA2562ce28859e79a3236cd72465f3bea5c7ff129ee6532987d17bdfbc6be10dd91b5
SHA512955d2d7cb373d6617ee916f7dd8369d53de4ce92187c3070439e20ca477a8b3db24f940ef31019ce35dec90f12239cb4b74db11af17a7c78617ffc7c801efe4e
-
Filesize
74B
MD51829fd58a6185c1a056cea7d75d1cd17
SHA1d20f470e23c8474bdf9fa302a21943460a6a9ccb
SHA256b3626ce9251c8b0cab401d48763c8f9395ef15c2fb4e7d0f371ca45e4f92a478
SHA5129dd91c929ca2f210d54b2cf75a3ae83efd33d98fa1ab4965f8fbb1f83fd6687fed86a75b01c16d22d6b6a7a7cd1d083db71179f61138288f53fca6102db5fd59