Overview
overview
7Static
static
3b6a225b4d7...18.exe
windows7-x64
7b6a225b4d7...18.exe
windows10-2004-x64
7$PLUGINSDI...am.dll
windows7-x64
3$PLUGINSDI...am.dll
windows10-2004-x64
3$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/nsisos.dll
windows7-x64
3$TEMP/nsisos.dll
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2024 06:17
Static task
static1
Behavioral task
behavioral1
Sample
b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/DLLWebCount.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/DLLWebCount.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$TEMP/nsisos.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$TEMP/nsisos.dll
Resource
win10v2004-20240802-en
General
-
Target
b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe
-
Size
126KB
-
MD5
b6a225b4d7e337a4a23be5cb588b0611
-
SHA1
36fa48acca39a6aaf51259e9365a68dc89407295
-
SHA256
919b5fd2a8bda40202bbdd2d44202bd52ee0e104a85cf50dbf315ac64ea1558a
-
SHA512
e7b8be081d13f79826b155f6b14b6e64df87f4af617d771d0eaf8935b18ebe17a528bc7a5b98dc651ef8eb29b03424c64524dbee2bcd5a2d8e58d8cdddde25d4
-
SSDEEP
3072:bgXdZt9P6D3XJNHXE0Kbh5FXUcE6rF6tcBp/:be343HXEV06rF8Eh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 436 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 436 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023434-3.dat nsis_installer_1 behavioral2/files/0x0007000000023434-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3596 wrote to memory of 436 3596 b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe 84 PID 3596 wrote to memory of 436 3596 b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe 84 PID 3596 wrote to memory of 436 3596 b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b6a225b4d7e337a4a23be5cb588b0611_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5eef9e469e8a30717974499f277d97e2a
SHA12d33c25984ebd9116beeb55cdde4c5c86c023e5d
SHA2561f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078
SHA512d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48
-
Filesize
580B
MD5a38db643b7954a75bce5f2cb9bd39697
SHA15303c78100d9f15a46845ec0cb98c61e2f08e192
SHA256ee544a55dcdfb72950d384b1c22a88a7518abeb8b1c29a4029185412cf21c5fb
SHA512f49cedc51a285cae333127ab69967a11186fddf11702237f21b4e2898a00f978b330d2835fea28003bdd24970c0551dfa458a47047d64ae98efaa989acad49bc
-
Filesize
619B
MD5875e26f9fbbc31442bc2d584bdf8232d
SHA110a6d229c98b362ac7f424f18fa7eb8ffae4bc02
SHA2567db88bcd9c841974a02643ce12c0497393c26b7ffddd035037aded75241b71fe
SHA5125ec814ce8573ea90d5aeb0100ef976e862e7ace326149df330bf988502834d374f0139ce5fe4718f703306c6a0ac56b36c0587dfd42d23e1fd5badf14b8837bb
-
Filesize
126KB
MD5b6a225b4d7e337a4a23be5cb588b0611
SHA136fa48acca39a6aaf51259e9365a68dc89407295
SHA256919b5fd2a8bda40202bbdd2d44202bd52ee0e104a85cf50dbf315ac64ea1558a
SHA512e7b8be081d13f79826b155f6b14b6e64df87f4af617d771d0eaf8935b18ebe17a528bc7a5b98dc651ef8eb29b03424c64524dbee2bcd5a2d8e58d8cdddde25d4