e197e28bd08c56c2ab5abc663ce11d56221bacdda99305e1cdb614300340d5e3

Analysis

max time kernel
141s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
207af6c7fe675ee4d6b0be1c1b6d6709_JaffaCakes118.exe
Size 26.5MB
Sample240507-nzeg7aee8t
SHA256 e197e28bd08c56c2ab5abc663ce11d56221bacdda99305e1cdb614300340d5e3
MD5 207af6c7fe675ee4d6b0be1c1b6d6709
SHA1 6e3c59bd75c091d79fbe3381a5617d6e62a73238
SHA512 8a455d0e25bd2364b9b1867918aa72c7554883132d98520eda95ede03c3f3dfa96e4710ae8bc8f0ca45d5a8c334b4383f85c6367e11a3b290fc1b7e2b8fd2772
SSDEEP 786432:6UUe68MlS+Q0++07l3sHnXkkezz5ATAzREx:6UUUkxQ0+RSnXkkizUURq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000023bc0-27.dat	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023bc0-27.dat	upx
behavioral2/memory/3484-31-0x0000000074E90000-0x0000000074EE5000-memory.dmp	upx
behavioral2/memory/3484-112-0x0000000074E90000-0x0000000074EE5000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
3484	207af6c7fe675ee4d6b0be1c1b6d6709_JaffaCakes118.exe
3484	207af6c7fe675ee4d6b0be1c1b6d6709_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\207af6c7fe675ee4d6b0be1c1b6d6709_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\207af6c7fe675ee4d6b0be1c1b6d6709_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MPlugin_NSIS.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg3D2A.tmp\MPlugin_NSIS.dll
Size 129KB
SHA256 aff4ad05560e008405701fa96429534df248583f6cb08ffbd176308ab138f3c0
MD5 0d2f4fed90514e377396c288eb8a6431
SHA1 3746135d80eb281e5e17e182f984d94cb9d252d5
SHA512 68632616b78d8c5f456f5a56788f790e65413aec03f8e4ac4d0121d5e7d822ff9f833a938ea65a6286fb3065f6e7af1b28c8d9c59a6298b6956427f479f59cc7
SSDEEP 3072:tHMj00cvtv/RfRoa2MU2ycWlediMtabh1o2:B50c1v/hRKt2jWXSat1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg3D2A.tmp\nsDialogs.dll
Size 9KB
SHA256 60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
MD5 2aba8f16eca82517460013a3de7cbf67
SHA1 3812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA512 4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
SSDEEP 192:zGdYhqlJcsISwqIioU3MSfSLF/+nhHUXgECs3:zGGhGKuwqDoWcFGBUwECs3
MD5 SHA1 SHA512 SSDEEP