Overview

overview

7

Static

static

7

0d5b752231...18.exe

windows7-x64

7

0d5b752231...18.exe

windows10-2004-x64

7

$PLUGINSDI...er.exe

windows7-x64

7

$PLUGINSDI...er.exe

windows10-2004-x64

7

$PLUGINSDI...BI.exe

windows7-x64

7

$PLUGINSDI...BI.exe

windows10-2004-x64

7

$PLUGINSDI...cc.exe

windows7-x64

7

$PLUGINSDI...cc.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ed.htm

windows7-x64

3

$PLUGINSDI...ed.htm

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...lp.dll

windows7-x64

3

$PLUGINSDI...lp.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows7-x64

5

$PLUGINSDI...ay.dll

windows10-2004-x64

5

$PLUGINSDI...st.dll

windows7-x64

3

$PLUGINSDI...st.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    125s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 01:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0d5b752231b6763425b70204f4014bcb_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    0d5b752231b6763425b70204f4014bcb

  • SHA1

    e5ba66bcde84b55866b3ea2472a9fdbd4d514fa4

  • SHA256

    0c3e5ebfaaa4229b5583992c4ba0a543e5047689220ccc2b8054c801e9361112

  • SHA512

    d570a539a09864eef2b8cbf93c564573e2e6b2e7f38239ecca129e6f0ffff00f7a6531bd85a2161f167720e1150e513d5cda7a53e1b15cd08de0ca41bf8c7f34

  • SSDEEP

    24576:0Rrkba6AXihS8XvoKLjKJOX0dMzBoyEmzxKbgUKFvm:4wb9h5XwKL2QXQyp9iKFvm

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d5b752231b6763425b70204f4014bcb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d5b752231b6763425b70204f4014bcb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\nsfEF6D.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsfEF6D.tmp\BI\BI.exe { "json_send_time" : "3/10/2024 3:46:59:655" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "37487" , "user_type" : "NULL" , "result" : "Success" , "user_operating_system_bits" : "" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "" , "user_acount_type" : "" , "user_ie_version" : "" , "user_default_browser_version" : "" , "user_default_browser" : "" , "user_service_pack" : "" , "user_operating_system" : "" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130825.01" , "bundle_id" : "1138b911-2e24-4549-a271-08bf29426c96" , "machine_user_id" : "{9F988487-44CA-494C-9745-29BFB87A2799}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "2D9D57F6-6F0E-4E3A-A233-03E5CFA835A4" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "1.0" , "phase" : "Init" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2020
    • C:\Users\Admin\AppData\Local\Temp\nsfEF6D.tmp\BI\BI.exe
      C:\Users\Admin\AppData\Local\Temp\nsfEF6D.tmp\BI\BI.exe { "user_ie_security_level" : "Medium-High" , "json_send_time" : "3/10/2024 3:47:48:561" , "internal_error_description" : "HttpPost result: try1- SendRequest Error; try2- SendRequest Error; try3- SendRequest Error" , "internal_error_number" : "3" , "is_parallel" : "0" , "mrs_id" : "" , "vector_id" : "" , "rule_id" : "" , "product_id_version" : "" , "product_type" : "" , "product_id" : "" , "offer_id" : "37487" , "general_status_code" : "2" , "duration_details" : " InitPluginsDir:0 initializeParams:93 load_BITool:0 send_BI_Init:16 load_DownloadACC:16 retrieveUISource:0 unpack_webappfolder:0 unpack_icon:0 RetrieveMainOfferKey:0 unpack_OpenCandyDll:31 unpack_BunndleDll:0 load_webapphost:0 unpack_ProxyInstaller:15 navigate_loadingUI:610 navigateAsync_constMainOffer:0 BuildUserProfile:0 retrieve cid:0 callService1:16156 callService1:16016 callService1:16047 " , "phase_duration" : "" , "error_details" : "Failed communicate with the DistributionEngineService. Inner Error: SendRequest Error. InternalRetryNum: 3" , "result" : "Error" , "user_operating_system_bits" : "64" , "current_default_search" : "" , "current_homepage" : "" , "current_toolbars" : "" , "attempt_number" : "1" , "is_silent" : "" , "user_ms_dotnet_framework_ver" : "4.0" , "user_acount_type" : "" , "user_ie_version" : "9.11.19041.0" , "user_default_browser_version" : "9.11.19041.0" , "user_default_browser" : "IEXPLORE.EXE" , "user_service_pack" : "0.0" , "user_operating_system" : "Windows 10 Enterprise" , "revision_number" : "0" , "build_id" : "00000000" , "dm_version" : "1.3.8.0.130825.01" , "bundle_id" : "1138b911-2e24-4549-a271-08bf29426c96" , "machine_user_id" : "{9F988487-44CA-494C-9745-29BFB87A2799}" , "send_attempt" : "0" , "channel_id" : "" , "installation_session_id" : "2D9D57F6-6F0E-4E3A-A233-03E5CFA835A4" , "publisher_internal_id" : "1" , "publisher_id" : "Brothersoft" , "publisher_account_id" : "A-1477560" , "order" : "2.0" , "phase" : "InitComplete" , "Is_Test" : "0" }
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2040
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
    1⤵
      PID:1088

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsfEF6D.tmp\BI\BI.exe
      Filesize

      75KB

      MD5

      74cb7b0a801435c552d3bfd1517491a1

      SHA1

      a46e6e1b524a608eed9e81fd7e102e280b2e95c1

      SHA256

      fe0af5e14e37fd0b642aa08495ae63a4ed441c92909dfd7a8a25a050b5ed097e

      SHA512

      fce908fce3e9f84740280af53813bcbed29abf3f976a2b6ba1c88a722877ce020241b36bd0cbbb4f793df9d262b413ad30198bb1e8345128b0ac5857209b3260

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsfEF6D.tmp\System.dll
      Filesize

      17KB

      MD5

      a4f38d1c7a480f5da1bb8097b8b939db

      SHA1

      b3129c2a0e61881381463f5e0cbbffa573daa845

      SHA256

      e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436

      SHA512

      fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsfEF6D.tmp\webapphost.dll
      Filesize

      760KB

      MD5

      ca7f07bcde734c3a3072841e412c45e5

      SHA1

      75c03a7b14b2827242447fec95e4869a76518747

      SHA256

      54c6ca5ddcc600bb6ffd283760b843cc0af41b7b9ea1767a9aa4826262c407fc

      SHA512

      2f134f85aaea11eb4dfbbda62efe1ce45c04781da5fb138231c2f62578c80a5cd9cbe45c901fd15c5a85c86f49f70ecf5cd8213e9784bc888f8581c8850ced1e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsgF058.tmp\inetc.dll
      Filesize

      29KB

      MD5

      dccdcb124064a1d9a5eb12232348b898

      SHA1

      f294fac154cb1c6c18fe054ac584f767594b93fb

      SHA256

      37adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e

      SHA512

      bd89bcd513bb7120db80e1115b4caceaa18c4ea863fe29b232002d447c3813133ff2849fcb2d4df45e3ff67e0e0d9d340d61060b9c74045b17efa5b1c1f5b05e

      Download Submit