Overview
overview
7Static
static
3b9b07066e2...18.exe
windows7-x64
7b9b07066e2...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3GinoPlayer.exe
windows7-x64
6GinoPlayer.exe
windows10-2004-x64
6Interop.WMPLib.dll
windows7-x64
1Interop.WMPLib.dll
windows10-2004-x64
1launcher.exe
windows7-x64
3launcher.exe
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
GinoPlayer.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
GinoPlayer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Interop.WMPLib.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Interop.WMPLib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
launcher.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
launcher.exe
Resource
win10v2004-20240802-en
General
-
Target
b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe
-
Size
333KB
-
MD5
b9b07066e266e04d377f96b55967a1f6
-
SHA1
1261b6b6aa15787c64c15247f245f2334bb4fab5
-
SHA256
abfda8ae99688153ce446924a7fa3b0c777ba866ed867547ed1b9c59d9df131b
-
SHA512
7cd64ed20654877dfb9c87cdba6f77734ecaef6516deb74768368045a3a54c17210ac322e969a7fbe39f86a132aea6775f36429f83e7196fe3c70846fc448115
-
SSDEEP
6144:Me34DouTmByUhpdaRNzObYmmObsKla/URyzHB1H6tjm2/Wn9EzEpLu2UC:NLB9daRAbYmmw8URsBJUb/W9EzoT
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2088 b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2088 b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b9b07066e266e04d377f96b55967a1f6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688B
MD5e5ea196761ae92f157d66a1ac74e7dfb
SHA130be3bcbcec76555b207c765b909db2c01a6bea0
SHA256c57c279c946365fbe28a8917c2fa2c1e9b7352e2e73777b136498e62b150f899
SHA512f6973de746e5e4b2f1b0e711ad14298155d2520fa0ed0a3a8ce3b81b2c890a9fac4f999bc037494e5d4ed3693c1b6ecf2d92af5b259779b4a393df960dbbb063
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf