Analysis
- max time kernel
96s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
25/09/2024, 02:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe
- Size 3.2MB
- Sample240925-da6j9stelf
- SHA256 3a34f5ac72a1dca350d30e3aee683d466707a56c5f115b12ac253738c0b78894
- MD5 f501ea9912536da80a09c3826fad1cd2
- SHA1 edcd6af4e2f34acf2c6f8f9807e08bdf4f503d3f
- SHA512 540d313ba430e0b45854c66b93894c8ca4e2149c449eb378a3c5a35580de152340887e96bf62fc9bb1dc08f58475fd1baa5d552037215f0001483d98dbc0570a
- SSDEEP 98304:tWLREULSdrxOM0DI2/fKXNzL06At/C03K17CskwG:KmUEOb7/idv06wC74v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
pid Process 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe 1124 f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created \??\c:\Program Files\baidubar\taobao.ico f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe File created \??\c:\Program Files\baidubar\qidian.ico f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f501ea9912536da80a09c3826fad1cd2_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsvDF84.tmp\ShellLink.dll
- Size 4KB
- SHA256 b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb
- MD5 073d44e11a4bcff06e72e1ebfe5605f7
- SHA1 5f4e85ab7a1a636d95b50479a10bcb5583af93f3
- SHA512 e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsvDF84.tmp\System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\°²È«ä¯ÀÀÆ÷.lnk
- Size 1KB
- SHA256 236397ce680623d3ca481b1a3f11b8535271eca868e9c6536e7b348cb4153acc
- MD5 08297c1b75883cd5eec523f435df616d
- SHA1 745984b6f202d1ca0e975c97c4ab36d296f24b99
- SHA512 b9ffd2765f5b73cccbeaa0834ebac867fee2904d725ab2234ad7d6a6cbf1ea167894e234b8ea8c9e565cf22dc46a0824863dba29b97bed91925c97682b48e464
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\ÌÔ±¦Íø.lnk
- Size 1KB
- SHA256 f82ea98b1ffe870d287b22c41633694360f0b343fd7e50ae5d379c774464e92d
- MD5 0efe1829d835ecc46764832151fd2069
- SHA1 6e2e5525797ea4f0eb94964e63670321d7c5bb12
- SHA512 90c9d311c38af30162a3fee45038dc7eea101621dfab1eb7406eff8d51b0cc05eef51d97f5807f8b8e9d4813ce4ea755c322731c445ec446588256a3760c2201
- MD5 SHA1 SHA512