Overview
overview
7Static
static
7d5cdb1b3c8...18.exe
windows7-x64
7d5cdb1b3c8...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ip.dll
windows7-x64
3$PLUGINSDI...ip.dll
windows10-2004-x64
3chrome/con...d.html
windows7-x64
3chrome/con...d.html
windows10-2004-x64
3chrome/content/bg.js
windows7-x64
3chrome/content/bg.js
windows10-2004-x64
3chrome/con...fig.js
windows7-x64
3chrome/con...fig.js
windows10-2004-x64
3chrome/con...ork.js
windows7-x64
3chrome/con...ork.js
windows10-2004-x64
3chrome/con...min.js
windows7-x64
3chrome/con...min.js
windows10-2004-x64
3chrome/con...rId.js
windows7-x64
3chrome/con...rId.js
windows10-2004-x64
3chrome/con...der.js
windows7-x64
3chrome/con...der.js
windows10-2004-x64
3plugins/np...TV.dll
windows7-x64
3plugins/np...TV.dll
windows10-2004-x64
3OutfoxTV/D...er.exe
windows7-x64
7OutfoxTV/D...er.exe
windows10-2004-x64
7Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 06:42
Behavioral task
behavioral1
Sample
d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsUnzip.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsUnzip.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
chrome/content/background.html
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
chrome/content/background.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
chrome/content/bg.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
chrome/content/bg.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
chrome/content/config.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
chrome/content/config.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
chrome/content/framework.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
chrome/content/framework.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
chrome/content/jquery-1.9.1.min.js
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
chrome/content/jquery-1.9.1.min.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
chrome/content/referId.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
chrome/content/referId.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
chrome/content/subscriptloader.js
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
chrome/content/subscriptloader.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
plugins/npOutfoxTV.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
plugins/npOutfoxTV.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
OutfoxTV/DesktopContainer.exe
Resource
win7-20240903-en
General
-
Target
d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
d5cdb1b3c898fad102ee3b0356e4a18b
-
SHA1
87930c2325a527ad385d69b2921fca9fbf364d3f
-
SHA256
36417b50b830fd546b1c674477404bd5a952b3387b25b13437f01bd898212197
-
SHA512
ae5abd6ea74430f1c031f75570a07972168ec334f3df0fcab25f4a65ddbc04a2508093c4ae0a745076d0ccde36ef7491c5c7550c9a522bb86b1d855efbe9fba7
-
SSDEEP
49152:SOmJm2lg7LzAFBfsLrBljNH579jB/GGZ+x5srJtWF8dT7HT1zCHpK:SOmUokL0FBf2tHHl9V/d+x5srJtWF87v
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exepid process 2904 d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe 2904 d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exepid process 2904 d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5cdb1b3c898fad102ee3b0356e4a18b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsdC3DC.tmp\ioSpecial.iniFilesize
684B
MD5bb7616b93a0ac68e2c6fca5df3b16203
SHA172ebfecc0981cdb498f0936e8a01e040c0609cb1
SHA2563c333050ac6762a6b4554588d1590e74fa9186bb7629d019a1420d975bac39cd
SHA51220bcf7b40fdf45f05cf5e1d18414009271555bc7f34cc0e70e46b0319b4a4b10d387d03dfe54892314ff0effba5f14af54cd57d4c2c37fcaaacab5f91049741e
-
\Users\Admin\AppData\Local\Temp\nsdC3DC.tmp\InstallOptions.dllFilesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
\Users\Admin\AppData\Local\Temp\nsdC3DC.tmp\UAC.dllFilesize
13KB
MD5bcec2a6095d38abc192a68d094c302d0
SHA19e88c5b957b45524690513b75d81dee259d5d599
SHA256446000200eff4f9c20761ce1680902daba190c81a57154f4917b1741d7800e3c
SHA512b48e85a17904a104eef573358763a0b1215eec96f72f83ff544d2dab22737bc42411ca505adf3f7e95c6f7e7997ad3e408f258093727105b678d5eee8d8e6278