d13edddb0e717789654a8218c4142318fc6195a1bf91bc7db5e0c0b3d4f47664

Analysis

max time kernel
142s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
Size

1.8MB
MD5

b42e93434e8d377a38214978c977527c
SHA1

8439427788ef2864f67a44eb89357a2938187a14
SHA256

d13edddb0e717789654a8218c4142318fc6195a1bf91bc7db5e0c0b3d4f47664
SHA512

f02b8050d2490703649f1f5fc3998e6dbb91600263622d2be83b1c991f7c204c6fb65df3044960a181a1e183848d05728710b0ccebadf71593f7f7414af61774
SSDEEP

49152:w/ixbpVndRcpfqwYO3u2XoKNLlMDEe/pmVS/F0jN6:wadnfnwp3oOLuB/3/uo

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3608	install.exe

Loads dropped DLL 2 IoCs

pid	Process
568	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
3608	install.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Wplugin.dll	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
File created	C:\Windows\explorer.exe.local	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
File created	C:\Windows\ws2help.dll	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
File opened for modification	C:\Windows\ws2help.dll	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
File created	C:\Windows\Wplugin.dll	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe

Hijack Execution Flow: DLL Search Order Hijacking 1 TTPs
Possible initial access via DLL redirection search order hijacking.
defense_evasion

DLL Search Order Hijacking
T1574.001

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
568	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
568	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 3608	568	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe	91
PID 568 wrote to memory of 3608	568	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe	91
PID 568 wrote to memory of 3608	568	b42e93434e8d377a38214978c977527c_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\b42e93434e8d377a38214978c977527c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b42e93434e8d377a38214978c977527c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:568
- \??\c:\8eca16367ae0c556f6661cac7c3941\install.exe
  c:\8eca16367ae0c556f6661cac7c3941\.\install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\8eca16367ae0c556f6661cac7c3941\eula.1031.txt

Filesize
17KB

MD5
9147a93f43d8e58218ebcb15fda888c9

SHA1
8277c722ba478be8606d8429de3772b5de4e5f09

SHA256
a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded

SHA512
cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705

Download Submit
C:\8eca16367ae0c556f6661cac7c3941\install.exe

Filesize
549KB

MD5
520a6d1cbcc9cf642c625fe814c93c58

SHA1
fb517abb38e9ccc67de411d4f18a9446c11c0923

SHA256
08966ce743aa1cbed0874933e104ef7b913188ecd8f0c679f7d8378516c51da2

SHA512
b92a32b27d6e6187c30d8018d7e0a35bde98dc524eabcd7709420b499778159e2872db04a3f2dfacf016d0e6d97b8175920e83fa28804609786828e52f058ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Wplugin.dll

Filesize
108KB

MD5
8847a8302dacc1d6fca61f125c8fe8e0

SHA1
f399142bbf03660bee1df555ebbf3acc8f658cf0

SHA256
9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943

SHA512
2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f

Download Submit
\??\c:\8eca16367ae0c556f6661cac7c3941\eula.1033.txt

Filesize
9KB

MD5
99c22d4a31f4ead4351b71d6f4e5f6a1

SHA1
73207ebe59f6e1073c0d76c8835a312c367b6104

SHA256
93a3c629fecfd10c1cf614714efd69b10e89cfcaf94c2609d688b27754e4ab41

SHA512
47b7ec5fed06d6c789935e9e95ea245c7c498b859e2c0165a437a7bf0006e447c4df4beeb97484c56446f1dae547a01387bea4e884970380f37432825eb16e94

Download Submit
\??\c:\8eca16367ae0c556f6661cac7c3941\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\8eca16367ae0c556f6661cac7c3941\install.ini

Filesize
843B

MD5
0da9ab4977f3e7ba8c65734df42fdab6

SHA1
b4ed6eea276f1a7988112f3bde0bd89906237c3f

SHA256
672621b056188f8d3fa5ab8cd3df4f95530c962af9bb11cf7c9bd1127b3c3605

SHA512
1ef58271cdedbdc53615631cc823483f874c89c2d62e0678de9d469a82bd676eb8abd34656caa5128b7edb0eb24dbf0992e5e571a97f7782c933b2be88af3144

Download Submit
\??\c:\8eca16367ae0c556f6661cac7c3941\install.res.1033.dll

Filesize
89KB

MD5
9edeb8b1c5c0a4cd3a3016b85108127d

SHA1
9ec25485a7ff52d1211a28cca095950901669b34

SHA256
9bf7026a47daab7bb2948fd23e8cf42c06dd2e19ef8cdea0af7367453674a8f9

SHA512
aa2f6dde0aa6d804bcadc169b6d48aad6b485b8e669f1b0c3624848b27bcd37bd3dd9073bddc6bde5c0dd3bc565fd851e161edb0efe9fcaa4636cdcaaec966db

Download Submit
\??\c:\8eca16367ae0c556f6661cac7c3941\vc_red.msi

Filesize
227KB

MD5
e0951d3cb1038eb2d2b2b2f336e1ab32

SHA1
500f832b1fcd869e390457ff3dc005ba5b8cca96

SHA256
507ac60e145057764f13cf1ad5366a7e15ddc0da5cc22216f69e3482697d5e88

SHA512
34b9c5ed9dd8f384ecf7589e824c3acc824f5f70a36517d35f6d79b0296fbccb699c3ec1e86e749d34643934bf2e20a9c384a5586d368af9887b7c2cede9bfb8

Download Submit
\??\c:\8eca16367ae0c556f6661cac7c3941\vcredist.bmp

Filesize
5KB

MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit
memory/3608-42-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/3608-46-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download