0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe
Size

5.8MB
MD5

fc008e3aa4c44b45ac4a44a0be3ea0c2
SHA1

7d20bf1d39c557c4c19574d1b8f3a04c65a9915d
SHA256

0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783
SHA512

5bfb46e17ec8446f6221799e3cef7dd89f6be8adf35f84ac58a02fd0fa3cdd01d81e268676642af2f40a00e99de88dbf5fb4f6d3c27b6bf4af53f8593961be41
SSDEEP

98304:KM9bI6zz2VZncg4hte5NO/y7jmzvtbctqZ+Tn6RMQ7o38WyoUqYAV4Jaju5hDy3q:Lzz2XncXINO/dcqZin6D9reYAV4I6G3q

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe

pid process

2944 fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe
2944 fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe

pid process

2944 fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe

pid	process
2944	fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe
2944	fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe

pid	process
2944	fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc008e3aa4c44b45ac4a44a0be3ea0c2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd1594.tmp\ioSpecial.ini

Filesize
601B

MD5
ef34b9ea4196209bb5d993e33464d16c

SHA1
ba33de740c6ade3661a7b2e9985d27841e191897

SHA256
936b3a21b38f67a6cc4c24dfdb7a4f12ba1da0956a4de0ca1fab7655199bb86b

SHA512
cb428db97a75003006f0ceb4dd8ff37e01c344511efef38a480cd892ed27307c1006cfd59346f1096761d8e66258c69a99f123dc6bd3dafbe70364db4cf9153a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1594.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1594.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit