06a309da4d11f8c5fa36684878ece093fe4082c0ea758a5e8aee80f1c5a7e164

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 04:44 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe
Size

1.0MB
MD5

f0565ea03e24fb13903da7a936e0e7d7
SHA1

05b69adcf3212511398990bdbaee7a426f4f80ef
SHA256

06a309da4d11f8c5fa36684878ece093fe4082c0ea758a5e8aee80f1c5a7e164
SHA512

4bf6d3b4a3eec0594665cf7ba88e88b609ba1e4a1a73082489107259cafd6f2462031a9e904630ffff5f0317b485fd83d8f814af359e3b4551ba354a00b3c89b
SSDEEP

24576:jGiiO5MkR74d6sWBgTfEg78P/aYxKctGB2xEso8hMiAw4h:uobR7MlTd8PzXte2isoCMiAw4h

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2924	f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe
2924	f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe
2924	f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe
2924	f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2924	f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe
2924	f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:2924

Network

DNS

getoffers.shynther103.com

f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

getoffers.shynther103.com

IN A

Response
DNS

logs.shynther103.com

f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

logs.shynther103.com

IN A

Response

No results found

8.8.8.8:53

getoffers.shynther103.com

dns

f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe

71 B
144 B
1
1

DNS Request

getoffers.shynther103.com
8.8.8.8:53

logs.shynther103.com

dns

f0565ea03e24fb13903da7a936e0e7d7_JaffaCakes118.exe

66 B
139 B
1
1

DNS Request

logs.shynther103.com

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso2204.tmp\LangDLL.dll

Filesize
5KB

MD5
0d0152760fd9457de1428bf906a1e4ad

SHA1
05230deced9421a0adfc29d449fbd3217f63cfff

SHA256
b44799188e62ea99e950031258be135d813d3b0238dd41f7a5bb9f295247842a

SHA512
6442775f18140b43e84b2fa017fe2f6a6c205b2de358eb5e5022a8c1bfc2503a071c39283f395fa4151d434343ce5d84fc4e65fa6e026a46a1fc93aae7609e80

Download Submit
\Users\Admin\AppData\Local\Temp\nso2204.tmp\System.dll

Filesize
11KB

MD5
bc3f65870d0587f6f7a4090232ee44a0

SHA1
b026d717e7a4febc9d4a54772229d1054f92a0fa

SHA256
8d6d45caf932f0ae15657a9909ba168a9a4f85f8e4384dc8cc28685cc4df2b50

SHA512
94efe8ef1de201d0e5ee518dc071cf1c08b693467b934ea1160f74a0222cdcdb4f66efc454743980e5df41a5ae932daef6857f85298899a292eb08d75dfbd178

Download Submit
\Users\Admin\AppData\Local\Temp\nso2204.tmp\__322bce84428d4b59bfa82b2ee0a7394a.dll

Filesize
800KB

MD5
1bdcf2dfe1a5a7be39bd0993576bcb8c

SHA1
551d9869e4ca81ac566603dd2c705b9b91d359a5

SHA256
6cc892a8dd253cfab86690bf8f6f211ce13aa8c64c61337cf2741e2396ab8e14

SHA512
907a05253a255795da7403fac3a3c051e13903f24fcd8ef41ea41f8ceb78767ed149a1042a7b218212f7a93e58f967c9528f5f4e11c664860bc6406c6c583d64

Download Submit
\Users\Admin\AppData\Local\Temp\nso2204.tmp\nsDialogs.dll

Filesize
9KB

MD5
d58a98e4bcf7537f15b054876e40defb

SHA1
f8757c8a73ec6e30c090bb6779a23284d3b6fc68

SHA256
5e1f7272ae579c22da610c0375351a0ceedc830fe2e769261cc4881cbf847814

SHA512
12aff5e506f901ded9147a2d3a3ebd0c42b344d6688ea53dca959d90094090d63e13f6b0c46372fe4fbae5d923c316e9cb1d56e993a38102e641e2ba7d96e9ec

Download Submit