fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
Size

3.0MB
MD5

a4d7c3a88165ffc52a9fc2edcc662805
SHA1

b4902b7975a244bdfe82174ccc2358c3b822831b
SHA256

fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926
SHA512

cfb5092b19971a3047365eff3d7137079e071fb334cec4122b17dd49641611381d5a09ad6e295b5b001f1b70b5b185f37da3b0b4a7d8dbc7eae6ad2a674d40f2
SSDEEP

49152:qIjfWJqyJzAfjd15q0KuL7rcLXYRQHUYx4JkUnVrPsVo3UcqcCGGIql:qOfsJzAd15C87MXYuHUx9psVo3onl

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid process

3800 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
3800 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid process

3800 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
3800 a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid	process
3800	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
3800	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

pid	process
3800	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
3800	a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4d7c3a88165ffc52a9fc2edcc662805_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3800

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss4EAE.tmp\InstallOptions.dll
Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4EAE.tmp\Processes.dll
Filesize
56KB

MD5
cc0bd4f5a79107633084471dbd4af796

SHA1
09dfcf182b1493161dec8044a5234c35ee24c43a

SHA256
3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c

SHA512
67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4EAE.tmp\ioSpecial.ini
Filesize
702B

MD5
882a8fd0085086ebadcea31452a251b7

SHA1
57db5d4b1fcd18d882ad61dce815240bad8ac5ba

SHA256
edb44880ac533c14e2aaf93ca4a4da7b46ad979b86806ddea1c8063c934ddfee

SHA512
ab04cfc3c85011fe3de05f6a106690b7eac3775ca679cb5274b42fbb3352e7f8f54586a84c875c923da1fac346675be3909ff3835f6a37499b605d5999f4430b

Download Submit