Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
General
-
Target
d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe
-
Size
83KB
-
MD5
d56e7a8e14d2b01a4f76df979b78fa0b
-
SHA1
e4697c9be78fd6a2fb38313b3c6c28e196d74b97
-
SHA256
45b6ccc9ef099824147337d1896abae64507649e52ae989332ef07dd60c1f748
-
SHA512
7e9dd3a9430ef6281b1114022a1e51c9750a2890747861b5ebe65b3821810483c92317ffee39524de1e937b400a031aec9acf6feae2e4a7227813acb99e3a28f
-
SSDEEP
1536:3EkjY1zy214Qay0DGkJ7qAELVigJGKcpp0bUYr9H63dZZ2/DoO:UkjAJ4dDGkJ+AI0drsUYk3d6/t
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4564 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 4564 Au_.exe 4564 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234b3-3.dat nsis_installer_1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3412 wrote to memory of 4564 3412 d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe 83 PID 3412 wrote to memory of 4564 3412 d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe 83 PID 3412 wrote to memory of 4564 3412 d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
619B
MD53d2b4147fc792e9d5c23c2a5010d3841
SHA1e60f15703c8cfc6666abfc20e87a5383dcfca27f
SHA2561945bc765fb95848a1595faed311ef6747812e67251d78e17f9a72d30b41e40e
SHA512fad674a500f2eb49b8d0f8a9498cee4560a62c2ee3de601700fbd6a2618ead6e8a710582ba49d414a8a353ef5814500a68945a0f91c98a4a6c8cb58ae6347bc7
-
Filesize
83KB
MD5d56e7a8e14d2b01a4f76df979b78fa0b
SHA1e4697c9be78fd6a2fb38313b3c6c28e196d74b97
SHA25645b6ccc9ef099824147337d1896abae64507649e52ae989332ef07dd60c1f748
SHA5127e9dd3a9430ef6281b1114022a1e51c9750a2890747861b5ebe65b3821810483c92317ffee39524de1e937b400a031aec9acf6feae2e4a7227813acb99e3a28f