777730664beeade5b6f7b22e8dab7682caa8dfa1456b4c503be930f857265cea

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11e12e0c4d93c8d9f2efc3787cc100c0_JaffaCakes118.exe
Size

161KB
MD5

11e12e0c4d93c8d9f2efc3787cc100c0
SHA1

12b61e351415a72f67afe5e7d6650c1443b47413
SHA256

777730664beeade5b6f7b22e8dab7682caa8dfa1456b4c503be930f857265cea
SHA512

7ecc0f2582171b5660b51fef1e2a54464450163a382d6818f68727e23668d5007ee7e19e0afcec0d6780a7864ed41ebb85dead3eeb5eaedd999d4dc8521525ce
SSDEEP

3072:fLk395hYXJkmCQMpywCP9EuToe4kNnuB6J0y0dxXiQbLUd/FVhfY2V7kl:fQq6mCQMpLCF1gSnuAJ0y0dxXXLUxFv+

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2252	11e12e0c4d93c8d9f2efc3787cc100c0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	11e12e0c4d93c8d9f2efc3787cc100c0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\11e12e0c4d93c8d9f2efc3787cc100c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11e12e0c4d93c8d9f2efc3787cc100c0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyEC1.tmp\ioSpecial.ini

Filesize
711B

MD5
ef195f88f1755838f2778f898b1c92ea

SHA1
b11563b56784eebb284168018a33c5fd3f701828

SHA256
e6bcc0fd2d414664d0d56a31dd75cb98d88e7cef5a7ca869f6c6516fbf147b25

SHA512
e9e696b6dee9a8170b38ce048bd4e28ad0660dcc39af02a61f1642207f3a637d1cd9db20a3f5bf9d2e8ee854e549e04844137b0b95fcfb25152a67f707af3845

Download Submit
\Users\Admin\AppData\Local\Temp\nsyEC1.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit