Overview
overview
7Static
static
75287b802de...18.exe
windows7-x64
75287b802de...18.exe
windows10-2004-x64
7$PLUGINSDI...ay.dll
windows7-x64
3$PLUGINSDI...ay.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
7$PLUGINSDI...ll.dll
windows10-2004-x64
7messenger.exe
windows7-x64
7messenger.exe
windows10-2004-x64
7$PLUGINSDI...ay.dll
windows7-x64
3$PLUGINSDI...ay.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
7$PLUGINSDI...ll.dll
windows10-2004-x64
7Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 15:33
Behavioral task
behavioral1
Sample
5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/md5dll.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/md5dll.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
messenger.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
messenger.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/md5dll.dll
Resource
win7-20240729-en
General
-
Target
5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe
-
Size
154KB
-
MD5
5287b802de9244a7065e448ea99a8f7d
-
SHA1
fdfb9dfe825cee7d392a65cdf9859c233a84d1f6
-
SHA256
a56b4927a068cd111b9cf680dd114167550d20c730858db7e892ca57a1000be7
-
SHA512
b14b8a5442e12cc2dfc7b7d03cdf5040505f9f379bf27a54f5463441b8fd25da1a93c752160b6d404062ef820ab5c4d6690a24c5c029341378313f6eefcda4d4
-
SSDEEP
3072:bgXdZt9P6D3XJTvJFQP5Kyx3tnvV7UmyHRyv5IDdL5Kyx3tnI:be34dvwUyZtnN7YHRyvClUyZtnI
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\messenger.exe = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Components\\messenger.exe" 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000e000000023bb4-4.dat nsis_installer_1 behavioral2/files/0x000e000000023bb4-4.dat nsis_installer_2 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1068 5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5287b802de9244a7065e448ea99a8f7d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD514b848866035dea39b912da628307231
SHA1d00c8963aee8038d8a22f098cef69b31007196e5
SHA2566a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
SHA5124538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
91KB
MD5906abdead3cf2f1083b28df6e8a9c5ae
SHA12f47440a58b1fa3e157816219ae817ab694b2b4c
SHA25644526798ec60017fdc8b5f7b6b744ea42e7a54522d1a4fb83fe4439e1c439b2e
SHA51275bfd6d27867fbfe3254962489a76aab016f8efc34bc4326df6b23bb6fa9d2a44da683a0c443b38d728c5b640673c99c40c2342619d47d7f4e0b6488d7c30dba