fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
Size

3.0MB
MD5

a4d7c3a88165ffc52a9fc2edcc662805
SHA1

b4902b7975a244bdfe82174ccc2358c3b822831b
SHA256

fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926
SHA512

cfb5092b19971a3047365eff3d7137079e071fb334cec4122b17dd49641611381d5a09ad6e295b5b001f1b70b5b185f37da3b0b4a7d8dbc7eae6ad2a674d40f2
SSDEEP

49152:qIjfWJqyJzAfjd15q0KuL7rcLXYRQHUYx4JkUnVrPsVo3UcqcCGGIql:qOfsJzAd15C87MXYuHUx9psVo3onl

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid process

1912 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
1912 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid process

1912 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid process

1912 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid	process
1912	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
1912	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid	process
1912	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid	process
1912	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1912

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\ioSpecial.ini
Filesize
702B

MD5
5c52ed170bfaae2dc53e1d6647411e6a

SHA1
a860d6bcf8bf03c3b2590ccb840eb096de2720e4

SHA256
ed8bcdae7901f90e37c3bb81a75f3a63f3cd174a73ffaf3dcebb059223f53830

SHA512
f05c8e8eddf4e88698c59a717a5dbdc6422b7b51bae913fc4c5616c1dde4beb74b3e54b32baaa1a623b1c6257552dfde7c777d86a9299fab8c41b22c5743bd14

Download Submit
\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\InstallOptions.dll
Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\Processes.dll
Filesize
56KB

MD5
cc0bd4f5a79107633084471dbd4af796

SHA1
09dfcf182b1493161dec8044a5234c35ee24c43a

SHA256
3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c

SHA512
67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

Download Submit