Overview
overview
7Static
static
33f7959fa3e...18.exe
windows7-x64
73f7959fa3e...18.exe
windows10-2004-x64
7$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows7-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
32345Explorer.exe
windows7-x64
2345Explorer.exe
windows10-2004-x64
2345ExplorerReg.exe
windows7-x64
2345ExplorerReg.exe
windows10-2004-x64
Addon/Capture.dll
windows7-x64
3Addon/Capture.dll
windows10-2004-x64
3Coral.dll
windows7-x64
1Coral.dll
windows10-2004-x64
1CoralApp.dll
windows7-x64
1CoralApp.dll
windows10-2004-x64
1CoralDb.dll
windows7-x64
1CoralDb.dll
windows10-2004-x64
1CoralDownload.dll
windows7-x64
1CoralDownload.dll
windows10-2004-x64
1CoralExtract.dll
windows7-x64
1CoralExtract.dll
windows10-2004-x64
1CoralHtmlWnd.dll
windows7-x64
1CoralHtmlWnd.dll
windows10-2004-x64
1CoralRender.dll
windows7-x64
1CoralRender.dll
windows10-2004-x64
1CoralTrident.dll
windows7-x64
1CoralTrident.dll
windows10-2004-x64
1CoralUI.dll
windows7-x64
1CoralUI.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 11:01
Behavioral task
behavioral1
Sample
3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
2345Explorer.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
2345Explorer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
2345ExplorerReg.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
2345ExplorerReg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Addon/Capture.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Addon/Capture.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Coral.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Coral.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
CoralApp.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
CoralApp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
CoralDb.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
CoralDb.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
CoralDownload.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
CoralDownload.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
CoralExtract.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
CoralExtract.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
CoralHtmlWnd.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
CoralHtmlWnd.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
CoralRender.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
CoralRender.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
CoralTrident.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
CoralTrident.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
CoralUI.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
CoralUI.dll
Resource
win10v2004-20241007-en
General
-
Target
3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe
-
Size
8.5MB
-
MD5
3f7959fa3eac1c799f52f8bcaff2817e
-
SHA1
ca4cd0bfef98aa9f8b0c9ef53401e4e10e83d180
-
SHA256
0b1bbcb0197ca224707d9c51818e44d78d40e1964d1e7e8c016e1c87c0c71151
-
SHA512
b702a41ad5d73a8be6f657eadeb4db49b51c944657a0b3c9bb4d87062b7074f09b9eccb66fc10963b539bfcd0af53c574d71ac20b31eddc338b1719febe4f8f1
-
SSDEEP
196608:EdW8H9CG8mv6xEfOsHoHSJT5xJ5hpXntrmHu:YCG8mbb9J5DtrSu
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2080 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe 2080 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\2345Soft\2345Explorer\2345Explorer.exe 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\Coral.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralDb.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralUI.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\2345Soft\2345Explorer\2345Explorer.exe 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralApp.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralDownload.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralTrident.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralUpdate.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralRender.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralExtract.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe File created C:\Program Files (x86)\2345Soft\2345Explorer\CoralHtmlWnd.dll 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f7959fa3eac1c799f52f8bcaff2817e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5c3b2ef9dc45c456200b42708da387038
SHA18029d50b42e6982d2590dbbca9029912f79be976
SHA256f192abf8ab296a4f3be18171a7c7c9599bbe4e6040d0dc391ca8a303e23009d0
SHA512b79cdcc230a508ac858b1c598db3806622d40e05f73b20a234e3f00c18e54047ec9ff717fa409348c5ad29bf89aa783b6ce4e27513fab667db15511583f46b13
-
Filesize
18KB
MD52bd4ba3e08273bea5de1a34d9888fd58
SHA1a1c89adb5b3aff6789ba0ffc613cfd26392931f5
SHA2560975b58f740e61ff50081f0acb4d60f14938979de24616e8c28912b1b690612c
SHA512f625a28f4a6070e35ad61f91c772178f23edf4826ef243746b51c3404609a7ff42e7d10074b55b0ca7ac42ff53a5d501ab00859b98a00011975cbb4f983903d1