49bee1b16b4d90af83eaa48409495e5c9aee2e3bd16ce98b451f4bf4893773a4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcac3171f24db9db8e554ba78765821f_JaffaCakes118.exe
Size

1.5MB
MD5

fcac3171f24db9db8e554ba78765821f
SHA1

f7cc2499f1b6d391fcf8d364a280d579c7a768f4
SHA256

49bee1b16b4d90af83eaa48409495e5c9aee2e3bd16ce98b451f4bf4893773a4
SHA512

59d4638983ef4d41e230df46c0a33efcfda591913af101e05188eb16b42e2db2a75f108802137491f18c690c4aed31f0675ac44f0cba8f2fa47d93516e19183b
SSDEEP

24576:cablz0yECLlB/tWfcYh2mCqGWP+068pJJumbV54INit/Wnacwc5OSXbMC9cPK8ru:bbtYZ0mHtHJJwFWaA5OSXz9ci2ry92x4

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2188	fcac3171f24db9db8e554ba78765821f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	fcac3171f24db9db8e554ba78765821f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fcac3171f24db9db8e554ba78765821f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcac3171f24db9db8e554ba78765821f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoF20.tmp\ioSpecial.ini

Filesize
632B

MD5
999d24d017874f0bc6e667bddbd1a1bd

SHA1
03ea61363620cf8f5177c9377540215f1f76cbed

SHA256
73ffaa70a37403a24bcb3d4ea502af0e716970df7c2487ff9cbc76be5174f516

SHA512
ce0df0e443a3bc5a4b4a450ade7d18c6cdeadd5ceba14f3cbce329756ff1e77e96574f20f1487ba8be22dd963a41c6efdceffc1802c700aff4e130bc9c67b0fe

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF20.tmp\InstallOptions.dll

Filesize
12KB

MD5
444e1109d960c307df0ca2b33a24731b

SHA1
55e3b57d06128911ed4af44858d199d9b1945edc

SHA256
b3ba181120cd5b57e2cd5435bbd64c3257f7525ade359f89554e93f466692125

SHA512
9efdb45ee0eae73c24d3f01ff799160090f2b1f0f28ee8da3af52992fec220bf905070ce5a6cc1b5657642440ad29c22bc6889cd3ee1f674a908a935dcf4c2a8

Download Submit