Overview
overview
7Static
static
7ac7491531e...18.exe
windows7-x64
7ac7491531e...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/nsSCM.dll
windows7-x64
3$PLUGINSDIR/nsSCM.dll
windows10-2004-x64
3$_3_/CrashRpt.dll
windows7-x64
3$_3_/CrashRpt.dll
windows10-2004-x64
3$_3_/EQCommUI.dll
windows7-x64
3$_3_/EQCommUI.dll
windows10-2004-x64
3$_3_/EQSandBox.exe
windows7-x64
7$_3_/EQSandBox.exe
windows10-2004-x64
7$_3_/EQSandBoxUI.dll
windows7-x64
3$_3_/EQSandBoxUI.dll
windows10-2004-x64
3$_3_/EQService.exe
windows7-x64
3$_3_/EQService.exe
windows10-2004-x64
3$_3_/EQShellUI.dll
windows7-x64
3$_3_/EQShellUI.dll
windows10-2004-x64
3$_3_/EQSysSecure.exe
windows7-x64
7$_3_/EQSysSecure.exe
windows10-2004-x64
7$_3_/EQUpdate.exe
windows7-x64
7$_3_/EQUpdate.exe
windows10-2004-x64
7$_3_/dbghelp.dll
windows7-x64
3$_3_/dbghelp.dll
windows10-2004-x64
3$_3_/lang/...st.exe
windows7-x64
7$_3_/lang/...st.exe
windows10-2004-x64
7$PLUGINSDIR/nsSCM.dll
windows7-x64
3$PLUGINSDIR/nsSCM.dll
windows10-2004-x64
3Analysis
-
max time kernel
99s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 20:25
Behavioral task
behavioral1
Sample
ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsSCM.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsSCM.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$_3_/CrashRpt.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$_3_/CrashRpt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$_3_/EQCommUI.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$_3_/EQCommUI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$_3_/EQSandBox.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
$_3_/EQSandBox.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$_3_/EQSandBoxUI.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$_3_/EQSandBoxUI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$_3_/EQService.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$_3_/EQService.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$_3_/EQShellUI.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$_3_/EQShellUI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$_3_/EQSysSecure.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$_3_/EQSysSecure.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$_3_/EQUpdate.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
$_3_/EQUpdate.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$_3_/dbghelp.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
$_3_/dbghelp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$_3_/lang/$_3_/uninst.exe
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
$_3_/lang/$_3_/uninst.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsSCM.dll
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsSCM.dll
Resource
win10v2004-20240802-en
General
-
Target
ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe
-
Size
4.2MB
-
MD5
ac7491531e15debeebb17a0fa830e3a5
-
SHA1
a81d261b50d41525cc5c751fb3e5074df7754962
-
SHA256
91b58b58645401d748ffbca177d56f705ddd981b79ff1758c7666590beaa228e
-
SHA512
51fa2115994302af955ff06b441a803e440e3cadd95386ab523e47c59e13099b242efd64a8105f9e875efb726cd32da0f056f8c335d18fd3c18a4c060c4869c3
-
SSDEEP
98304:RDe9IQTL3ErasIKsVwb369Qsw/XmlTfuE6JJzz62QAfQ2S:RYIM3E2sI3+b369QswelTmpjz2jArS
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2564 ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe 2564 ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe 2564 ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2564 ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac7491531e15debeebb17a0fa830e3a5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
729B
MD5ceeae55bf9b342dd5cad98a73f5aaea5
SHA12e124aa4bcab3e499950ed1be27fc3295b0056bc
SHA256a3174eecc10b410fbcef3be3ec3d1b9d2154e48c888a924363cc574ab2e9131b
SHA51277c68db941a62eabe28dd3d21a0366b7ae63163b6128e93cd7307829045b187d7f8b5227ab85587bf3948daaec444de29103e628cf02da10ca6cf60b93b7c094
-
Filesize
12KB
MD51d5c649dde35003a618b9679d5d71b92
SHA10409bbab3ab34f8c01289cdd847b4d1a32d05b18
SHA2560f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f
SHA512b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9
-
Filesize
10KB
MD54eff5fafd746f5decb93a44e3a3d570c
SHA1a11aa7681b7e2df1c7f7492a127d332d1495ea8a
SHA256cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5
SHA512cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72
-
Filesize
5KB
MD562efa7b730eb0523a026ea4325403b77
SHA1806ed3bd677ccf5d9817c9b464015e347f2c8f3c
SHA2560b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
SHA512748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b