Overview
overview
7Static
static
77477c2c0c9...18.exe
windows7-x64
77477c2c0c9...18.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 14:37
Behavioral task
behavioral1
Sample
7477c2c0c90c8f7ca5f264731205909d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7477c2c0c90c8f7ca5f264731205909d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20240709-en
General
-
Target
7477c2c0c90c8f7ca5f264731205909d_JaffaCakes118.exe
-
Size
89KB
-
MD5
7477c2c0c90c8f7ca5f264731205909d
-
SHA1
4dd6d8e8a52992ea94e144880b48de3608dfa87f
-
SHA256
0026d3f8150e11ebe398387f9f3bf1301f01d681b7e3752d2befe5772d3491cb
-
SHA512
f4097ebca8926f22775ab3ec1759588a5b35c8d4d350eed8865fb4823b6d0fe7c608faa61de5ff33ae8c8c978a99c2f62b3e38c0bfc2dd0530d881385497fc57
-
SSDEEP
1536:m223o0RyuVkofYRxYv0sDnpMU4H1zpk2MxxOyhDKQQ3r5b+8ZF73qBeGmxDBS9OI:m22Y4DkofYRxYv0sTpMU4H11k2MLDDK8
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1244-0-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1244-2-0x0000000000400000-0x000000000043E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7477c2c0c90c8f7ca5f264731205909d_JaffaCakes118.exe