Overview
overview
7Static
static
30b7419df1a...18.exe
windows7-x64
70b7419df1a...18.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...c3.dll
windows7-x64
3$PLUGINSDI...c3.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...it.dll
windows7-x64
3$PLUGINSDI...it.dll
windows10-2004-x64
3Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
02/10/2024, 15:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetc3.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetc3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsRichEdit.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsRichEdit.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe
- Size 253KB
- Sample241002-tc7s4svcnj
- SHA256 1c53ebe661032c1c34d719c239ed452345383f3b252da4315176d160e5dc5d07
- MD5 0b7419df1a25616cabc2ab48700d3c2b
- SHA1 fe4a962a60e7a151c3ce6868166889c888357d38
- SHA512 95c453b70c99b00bbbbfa244cea44bedb160e8a2fa522216e4839a45af4416313f67606ef154b1981038410205deab6741a0dc3241fc7ba4c8f1d9d4807c1dd1
- SSDEEP 6144:Lsv7FH1yd7PxUK0AgLiqldTTDhz5R1EgGlhv9PGtgZ:OJmPEDHT91Ejlp9ety
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 25 IoCs
pid Process 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\PutLockerDownloader.com\PTLextsetup.exe 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe File created C:\Program Files (x86)\PutLockerDownloader.com\uninst.exe 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe File created C:\Program Files (x86)\PutLockerDownloader.com\PutLockerDownloader.exe 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}\id0 = "02102024" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}\fn1 = "bbg|bby|by2|by3|by4|by5|by6-" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\ = "PutLockerDownloader URI" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\Content Type = "application/x-PutLockerDownloader" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\URL Protocol 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\shell 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F} 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}\fd2 = "02" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\DefaultIcon 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\DefaultIcon\ = "C:\\Program Files (x86)\\PutLockerDownloader.com\\PutLockerDownloader.exe,0" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}\fd1 = "02" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\shell\ = "open" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\shell\open\command 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\shell\open 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PutLockerDownloader\shell\open\command\ = "\"C:\\Program Files (x86)\\PutLockerDownloader.com\\PutLockerDownloader.exe\" /u=\"%1\"" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}\fn2 = "ftt|ddd|wbc-" 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe 4780 0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\1clogo.bmp
- Size 127KB
- SHA256 da7a0f562ab4168b2b17fd7e7903a073b26b6ccf1bd079c3bada8eb1a83eca37
- MD5 89b86b7029cc44a4711bf92145a610bb
- SHA1 a6334b866f19cca2848d6248afe9cc31af17d950
- SHA512 45ad593afea0959e4c374dcd0cbd086b687c2b86569e4fa446da6e43a028dd3a5b9861b7473d8a3190d00ca6a84a5be7e209dc6ecb120d0bb7440dfc6ddebc13
- SSDEEP 192:H4NPdUVrjFYUaSkkedw3WliSQBOtPnlyuxdGVkKgaeie/3fffffffffffffffff0:H4NPdUVHRFI3AObxdGVk0M/k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\accept2.bmp
- Size 16KB
- SHA256 f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e
- MD5 f642e8cfce23aa5d124533357de7394b
- SHA1 80ce98a2bc4b416db357ea52a74424d742cfaa55
- SHA512 d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26
- SSDEEP 48:Fg2CsFXtwOW3iC4CnE10DGGiGpUDQ1116ZlNCmNdFIz6PjfmMMrhHDaBr3g8uZ:Fg2lXtJz50DGXGUZrUmND3yMShj/84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\inetc3.dll
- Size 25KB
- SHA256 fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982
- MD5 9d8ce05f532dc7b5742831ec8a63c2d8
- SHA1 b014365f723c78a84bcdf8a46cfa016eb2b8dbc5
- SHA512 98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe
- SSDEEP 384:Aj+e6b0GUi0VV/0BiYkUm4i+Hr4Bc+AmPiMUTMF620Ac9khYLMkIX0+G2CykiDM:Aj+e6byNskUbi+Ly8xMSMj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\nsProcess.dll
- Size 4KB
- SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
- MD5 faa7f034b38e729a983965c04cc70fc1
- SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
- SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
- SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsl94EF.tmp\x.bmp
- Size 776B
- SHA256 1ff50d42ad12bc928f38ed8c4c9cbeb22bac386e68f54bec61d6a6b7904b71b5
- MD5 80730d8d5b1c7d04b9b2da32f778a229
- SHA1 535c3f57cf9fd1e53c7bd523fa41b5628fd5a5d3
- SHA512 5f6d180e2e67c6529ed6891575be725adcaa51b32a6c2f8e00f87a88a77ed5616d2c9c2bc2c842bba0c4217759064469fafdb4f9b5db1d81d28c29e298285536
- MD5 SHA1 SHA512
