Overview

overview

7

Static

static

7

cf4ba72f80...18.exe

windows7-x64

7

cf4ba72f80...18.exe

windows10-2004-x64

7

background.html

windows7-x64

3

background.html

windows10-2004-x64

3

background.js

windows7-x64

3

background.js

windows10-2004-x64

3

extension.js

windows7-x64

3

extension.js

windows10-2004-x64

3

js/api/analytics.js

windows7-x64

3

js/api/analytics.js

windows10-2004-x64

3

js/api/app_info.js

windows7-x64

3

js/api/app_info.js

windows10-2004-x64

3

js/api/chrome.js

windows7-x64

3

js/api/chrome.js

windows10-2004-x64

3

js/api/cookie.js

windows7-x64

3

js/api/cookie.js

windows10-2004-x64

3

js/api/debug.js

windows7-x64

3

js/api/debug.js

windows10-2004-x64

3

js/api/dom.js

windows7-x64

3

js/api/dom.js

windows10-2004-x64

3

js/api/fb_api.js

windows7-x64

3

js/api/fb_api.js

windows10-2004-x64

3

js/api/installer.js

windows7-x64

3

js/api/installer.js

windows10-2004-x64

3

js/api/message.js

windows7-x64

3

js/api/message.js

windows10-2004-x64

3

js/api/push.js

windows7-x64

3

js/api/push.js

windows10-2004-x64

3

js/api/request.js

windows7-x64

3

js/api/request.js

windows10-2004-x64

3

js/api/time.js

windows7-x64

3

js/api/time.js

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 10:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    cf4ba72f80e005e427a44fac893b704e

  • SHA1

    94e8e805a3bd0610a33161baac471266701e7012

  • SHA256

    639c78d0f88dc9ac25b65348bca153c1556f8f0570b2e025850e335fdf736ec7

  • SHA512

    53de1859130b419b58e4e99d13dc8c3b22fef5e57445b19d97d63e5b5f6a03db1bd62b64e818e2823a2d3c21b84eeee0872a06d4d1a57811bb9e5217bc405ffb

  • SSDEEP

    49152:P8tVzkdYt+6BBE5TNOG1LxcsN/exbpLH5CfizjnsH7NqbBjTvysE5T5t+6U:07zIYQMO0G1Lxd/ephZ9zjnfd3vDO5QN

Score
7/10
discoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cf4ba72f80e005e427a44fac893b704e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\bringtofront.exe
      C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\bringtofront.exe /bringwindowtofront=I Want This
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\I Want ThisInstaller_1725617287.log
    Filesize

    1KB

    MD5

    3aa7238f88d66bbdc49c0934f1000985

    SHA1

    036a634d89d939df302b824343c22b3edb531624

    SHA256

    f2819482a838e61af11c119b67c6e764be43a8ae9d738c3dd43b8d9689d5143a

    SHA512

    e62edb3131113c2790abe6edff4067d189a75e2f8e5ecd261ae5a0f32ca45adf06838384281bc33cb4b8dbe4e49aa8081fc877a930b2b7b28aedb7d826c7ebee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\I Want ThisInstaller_1725617287.log
    Filesize

    376B

    MD5

    dd96d9de41fb482b82bfb64bf9a65498

    SHA1

    079ab920593caa16a6411ec9bf0d9dfde29c4c20

    SHA256

    118eb81f3ebfce399bbb9e0ebe3b2987ffbf606611e83ab82a789943672b8340

    SHA512

    0bd41bba6e44543018b0d910d2eebac4737233fbb7aea4c1d7941dc6728e6ca8805134ca910015dbdc862516582fe8cf20fd7b01e9215be584a5bf89f8c7f946

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\Dialer.dll
    Filesize

    3KB

    MD5

    068ba6a2cece65f680895ea627f71e39

    SHA1

    27070d0fa949a80360426f37b3dfe9eaa0ed66f4

    SHA256

    ef649d2b3daed72b0778ab6b3f22a02e288fd009cf9e7e76eb1991451e580f82

    SHA512

    adf99b31790694d8ad02c56b1cb7c9dadeac49d492225a2d297654bfcd617f3afad23990d1d695fba03af1c355456e2e7c3e972eaa9b5ab1770bbb6eef0e733f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\StdUtils.dll
    Filesize

    14KB

    MD5

    21010df9bc37daffcc0b5ae190381d85

    SHA1

    a8ba022aafc1233894db29e40e569dfc8b280eb9

    SHA256

    0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

    SHA512

    95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\System.dll
    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\UserInfo.dll
    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\inetc.dll
    Filesize

    20KB

    MD5

    4c01fdfd2b57b32046b3b3635a4f4df8

    SHA1

    e0af8e418cbe2b2783b5de93279a3b5dcb73490e

    SHA256

    b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014

    SHA512

    cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\md5dll.dll
    Filesize

    6KB

    MD5

    0745ff646f5af1f1cdd784c06f40fce9

    SHA1

    bf7eba06020d7154ce4e35f696bec6e6c966287f

    SHA256

    fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

    SHA512

    8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\nsislog.dll
    Filesize

    42KB

    MD5

    e47100b70748fc790ffe6299cdf7ef2d

    SHA1

    ad2a9cd5f7c39121926b7c131816e7ba85aeead2

    SHA256

    271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

    SHA512

    88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsq6E5B.tmp\nsisos.dll
    Filesize

    5KB

    MD5

    69806691d649ef1c8703fd9e29231d44

    SHA1

    e2193fcf5b4863605eec2a5eb17bf84c7ac00166

    SHA256

    ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

    SHA512

    5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

    Download Submit

  • memory/1892-15-0x00000000033E0000-0x00000000033F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1892-276-0x00000000033C0000-0x00000000033D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1892-260-0x0000000002BC0000-0x0000000002BC9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1892-261-0x0000000002BC0000-0x0000000002BC9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1892-262-0x0000000002BC0000-0x0000000002BC9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1892-133-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1892-350-0x0000000002BC0000-0x0000000002BC9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1892-349-0x0000000002BC0000-0x0000000002BC9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1892-351-0x0000000002BC0000-0x0000000002BC9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1892-352-0x0000000002BC0000-0x0000000002BC9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1892-353-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/1892-356-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download