Overview
overview
7Static
static
375ae56b379...18.exe
windows7-x64
775ae56b379...18.exe
windows10-2004-x64
7"ElfBowlin...le.exe
windows7-x64
3"ElfBowlin...le.exe
windows10-2004-x64
3"aminstall.dll
windows7-x64
3"aminstall.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 20:53
Static task
static1
Behavioral task
behavioral1
Sample
75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
"ElfBowling_bocce_style.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
"ElfBowling_bocce_style.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
"aminstall.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
"aminstall.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
General
-
Target
75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe
-
Size
7.9MB
-
MD5
75ae56b379d6244f8b52d1fabc8ec2e8
-
SHA1
ba0000b186ac6cb1921d3663c0dc96b73fc27665
-
SHA256
d520316b0a826549ea56d37c6518ce869426b19e69541acbff157803c88a58c7
-
SHA512
9682bb8634e9b4bd0f9ef65447d907fa825e57fe485926c7fb78fffd5b4510a8c90558c29d97c24ca977e7064a1ecb2ba62b60ac5d8e11732ab2e5c3e83b913d
-
SSDEEP
196608:xo/owZET0hisUobMalDYj6Coej1WgpFps/XjMKT:2/owZETairobplDw/fhs/Xww
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2096 75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe 2096 75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2096 75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75ae56b379d6244f8b52d1fabc8ec2e8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720B
MD5a41305c48f7b1da9f09d8bd073381de1
SHA166242e237a8bfde9983411c9249e2ef761fd4dac
SHA2568161b30db77eb3c8d723509270b18814e3d7d12318ca1ffdc3d0dceb73e655dc
SHA5121abb35c8044cfc4f2a447b4da4cf3849601bc7200d9a33976c59ede6133ce97f1973579f884fdda6803e049b5d52dee5ffb9f11ce7bf209c56708fa4421a1614
-
Filesize
12KB
MD54c7d97d0786ff08b20d0e8315b5fc3cb
SHA1bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c
SHA25675e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84
SHA512f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a
-
Filesize
9KB
MD5e085476805e8f5ef1c7ed635c5309017
SHA1609e79fdc29d6dee40cc5dd333094db5f9f63eec
SHA2564eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67
SHA512082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f