Overview
overview
7Static
static
7b4cf2d93ba...18.exe
windows7-x64
7b4cf2d93ba...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/aeac...tb.exe
windows7-x64
7$TEMP/aeac...tb.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...st.dll
windows7-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDI...nz.dll
windows7-x64
3$PLUGINSDI...nz.dll
windows10-2004-x64
3$PLUGINSDI...ap.dll
windows7-x64
3$PLUGINSDI...ap.dll
windows10-2004-x64
3$PLUGINSDI...ro.dll
windows7-x64
3$PLUGINSDI...ro.dll
windows10-2004-x64
3$R0/AskSearchAsst.exe
windows7-x64
7$R0/AskSearchAsst.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 19:51
Behavioral task
behavioral1
Sample
b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$TEMP/aeac2814-61bf-4a12-8b11-c5ea3cfa382c/3rdparty/ins-installsphere-sntb.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$TEMP/aeac2814-61bf-4a12-8b11-c5ea3cfa382c/3rdparty/ins-installsphere-sntb.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/jsonparser.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/jsonparser.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/md5dll.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/md5dll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nshist.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nshist.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/sqlwrap.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/sqlwrap.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/timepro.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/timepro.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$R0/AskSearchAsst.exe
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
$R0/AskSearchAsst.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
General
-
Target
b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
b4cf2d93bab4987e99b6056cc1c2f613
-
SHA1
9e453855d6000d5c8a192eebcfcda0b3eae05a92
-
SHA256
9826c56553310f47f1c93419870ed935cc92b00cec23c7b0e04a275c00093c78
-
SHA512
b4e875f01dbfc253e2ddeac35c81756cbabf8121d521d1e6b183f8af21cdd56157c18be97ae312c70bce162d167b8dd46b3ef474e38b610b5839b046ae493db7
-
SSDEEP
24576:xIqpr552da20BSeveKyTiOxOlO07paHd7G:bFwd0fvKZxOxF2d7G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2464 Setup.exe -
Loads dropped DLL 2 IoCs
pid Process 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1068-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1068-64-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Setup.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main Setup.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2464 Setup.exe 2464 Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2464 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 29 PID 1068 wrote to memory of 2464 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 29 PID 1068 wrote to memory of 2464 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 29 PID 1068 wrote to memory of 2464 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 29 PID 1068 wrote to memory of 2464 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 29 PID 1068 wrote to memory of 2464 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 29 PID 1068 wrote to memory of 2464 1068 b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4cf2d93bab4987e99b6056cc1c2f613_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe"aeac2814-61bf-4a12-8b11-c5ea3cfa382c\Setup.exe" "C:\Users\Admin\AppData\Local\Temp\aeac2814-61bf-4a12-8b11-c5ea3cfa382c\index.html"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5f719a0f4fbdc6adcfaf69d5234dc132a
SHA1282f239f5f5adfb9651bb690e611085b9a5a7f80
SHA2564dbca5cf6f59d12ad106479b05ef5c1a0638b87e0e5fd971d29a203f1b47a74b
SHA512a562f1cf0e36a2fa9dc332fade15b46959f78fd22769a9cf842fe14f289cbd8e8fb69b46c65f9e04b98fe48e3846e3401637c636510e0d9344b591f1baa3beaf
-
Filesize
244B
MD513cf1e437106581c0cbd7a8a560918a5
SHA1ad9f44433a71cfc0ff2f5e5dbe64053a0ec943e9
SHA256d8ae1a18a8e51963dafd8eac17194cae91f785d469f2653df8daff12ef027c15
SHA512b3a3b489dffd0c6245cefd24a16eceed455be5e073d72e30ab948d9b8a22bd3254818f422b65a8803bc83389bdc2ff7f95afb615dd24567c39e07501cd7d3b6f
-
Filesize
5KB
MD5e99c30a014f2c52366a8b460553ce982
SHA16177a9c60e1027e908a4019321570992729ee7ef
SHA256e5dc8cc6f456ed8a36923946f962c04a38c13da21654d8977acf3012a2ec3bab
SHA512b4ac564f1fc728526277ac2fde64c56b6a5f3bc69e71a68a8688cc1f0fbecdd7e30b28219862864adf0028c770ee44ce74e6f509ae5759023cc286b2d5e9189c
-
Filesize
489B
MD5263e7937ad144efa91dc45e29a4238c5
SHA1baab29f7377b9bd43175d6e6cf0a7e317f3f3e48
SHA256b5f7d03b8819dbcef07a1cb98522e76e5f89770519cfca0d7799f711a579f7a5
SHA5121308bd31e98a67ca909a96ad46858bc5ff51774b88ea5934495dfe1bfd8312bfd86d0d01adb1cc4027a4bb15dc9b5e9965f45ba860eb25ec4d489e16b68014af
-
Filesize
4KB
MD5ceb254db6626fa437a395e52d2c11da2
SHA174c224224b7f8ffd209bf346cbd133e04655cb3a
SHA2565bab3a570e5e62cac658996a5db974b43a0a932d51ddffcc5e437ebd33ba0d39
SHA512625ca3564e7eb48e178f1440cdbb69c51e9fb21086f4eef8d210462c83de2a171dd4789f821687f9b877682532d05c1418b5e19f52f7bd94c039ea90ab93ab5e
-
Filesize
453B
MD59565c38ee56f996aac2fb0906cc1882c
SHA195ee88fca47973c939454d98bb8784f7082a8613
SHA256ac068ae6094a331acc49424d65e4c986f5e1a15df077476edbf38dd0de4817f8
SHA51275fbd81bed85a46e5da6a7c589e3ef12a9fdb6578dec95d0aea8f99af8e94440e7edcfdab8e15d87471b7a6d1dab53c293b466dedb1ca4778bf0fe1d25b9efc4
-
Filesize
2KB
MD5f831bb398578407ecfb03ac2ac12a725
SHA1b4ccf4aa0ac4f796e5d4f0f7e1f5004c1173c31a
SHA256ed577dffdb0291e142ff6d1c4a00d03d0c98482ee5c3fc12ed7585a19e2300a9
SHA5122643a6386e2f80b678d2d66258486d63e66975507aab382f1564804bc02630792316c2d57dbd8849b107e8e24a9c05352633bedeb65c82553e13e6827a5cd48d
-
Filesize
148B
MD5ef78dfa76fe087a66d8ebfa34c5f7b9e
SHA18d62509ae458125e3e3fdde063cb653b65b4d13b
SHA256a0a7b4fdde3e8b5c538d4506f4dac85f4794f5cfbba29397719ae170c57cefdd
SHA512b586ba703aaf592f91a29cc8ef23b5ff7fd4e19baf0f344fe16bbdb7a1689eda831cdf69877225859a95be2efe76a52b5e2de28d1fd3dcb5959cbbd4d04b0112
-
Filesize
43B
MD516616cf0c229b6b1e817a68c732cf889
SHA14f5b2f8372dcc50071491613eb75b04f57f529ee
SHA256a5701c519fef62adb3e854ddf459d62a1a79c0610071b056a2cace8532a92205
SHA512ddbc1f1a869bd76bbe9284f7825acaa0417285123b3085ac69b241a6eadd1d8b8993f669955952d7b9b6afbc0f546dd2308acb540469ff7b15310543c91337b9
-
Filesize
124KB
MD535c8675b6f9aab03082a91e29017e954
SHA1c89a743eb67ffa2325cc40c01d3c87558a639235
SHA256dd56b36a03e6ef0cba30ab2f9f37072f4a2e44a229ae3d6b8ff4c1546914fccf
SHA512a9c0382967613cf136f863d83cf8dce9a6c8d9c840bf263b7782fbf377e1940a2fb36a330ad307ba719f879564cd7ce296c102b71918ccd84cd3f27b68c5c327
-
Filesize
5KB
MD53c283c0123f825bbe0452dd02db776d3
SHA1b77d2f2adcdda5fd666df6e240bcdc35e61b2ff5
SHA2562b03ddbc59d18d890261bab13cab3613235607745508018cb8227d0153e79f57
SHA512bbd6760481660edec51220235f6e656d232a0c98d8197616a105ea1d149d83dfc0b70268e96d606281bd5744de56bced0eae3931e46a2cf8c6eeb8659183d783
-
Filesize
628KB
MD5dffd68ca4cbe112f5fd55f3e1bd1f9c8
SHA17d6f3584cd910dd2cbc1b65ea8105d35b65e9db4
SHA256b5ba6297685da0e59bf66e0557f1d3ded2c51211a8392de55c4bfe7896fc279d
SHA5126529472c62a8cd0255676a1d32c28c4b9c45d5369f4973ca4357af220e0c1df1ef12cfb80414d2f273350f4a1c3c0f55b4074729a8a2629a343a5d9f91a98a7d
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f