Overview
overview
3Static
static
35764665882...18.exe
windows7-x64
35764665882...18.exe
windows10-2004-x64
3$PLUGINSDI...if.dll
windows7-x64
3$PLUGINSDI...if.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SMSTARTUP...��.exe
windows7-x64
1$SMSTARTUP...��.exe
windows10-2004-x64
3$TEMP/Plug...er.exe
windows7-x64
1$TEMP/Plug...er.exe
windows10-2004-x64
3Encode.exe
windows7-x64
1Encode.exe
windows10-2004-x64
3EncodeBnd.exe
windows7-x64
1EncodeBnd.exe
windows10-2004-x64
3KwFlashHolder.exe
windows7-x64
3KwFlashHolder.exe
windows10-2004-x64
3KwInfos.exe
windows7-x64
1KwInfos.exe
windows10-2004-x64
3KwLogSvr.dll
windows7-x64
3KwLogSvr.dll
windows10-2004-x64
3KwMV.exe
windows7-x64
1KwMV.exe
windows10-2004-x64
3KwMusic.exe
windows7-x64
1KwMusic.exe
windows10-2004-x64
3KwUpdate.dll
windows7-x64
3KwUpdate.dll
windows10-2004-x64
3Analysis
-
max time kernel
16s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
57646658823c49a26a517e360746f2a7_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
57646658823c49a26a517e360746f2a7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/KuWoNsis.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/KuWoNsis.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$SMSTARTUP/ֺ.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$SMSTARTUP/ֺ.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$TEMP/PluginNotifier.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
$TEMP/PluginNotifier.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Encode.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Encode.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
EncodeBnd.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
EncodeBnd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
KwFlashHolder.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
KwFlashHolder.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
KwInfos.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
KwInfos.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
KwLogSvr.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
KwLogSvr.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
KwMV.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
KwMV.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
KwMusic.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
KwMusic.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
KwUpdate.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
KwUpdate.dll
Resource
win10v2004-20241007-en
General
-
Target
57646658823c49a26a517e360746f2a7_JaffaCakes118.exe
-
Size
4.0MB
-
MD5
57646658823c49a26a517e360746f2a7
-
SHA1
9f72601fb664358bc666a2754d41d81fd362b736
-
SHA256
74ae6f1ee17959064c9ceed0af1bbdf49d787860943967f9e936b9da2282f465
-
SHA512
a17d83671731422523e68e68e8d19e27d89a4fdb9810cc9e55d6484d92f090187344e4dbb5a0c1a1df6fa914962159252bd6e6d65d1450f80404ed5969f442c4
-
SSDEEP
98304:DrNGe8jAPHaYyP8IlpR5y8ORVbcZsXjsjCjaHuZW8i7:DrwjAfaTTzKbnXHri7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57646658823c49a26a517e360746f2a7_JaffaCakes118.exe