5e0590ed65ea7c0520665667829c7ef3ac2689a902a8be2417f09fffd8b5d2d7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe
Size

9.4MB
MD5

28d9ab7281ee136e40400a7b57d71b12
SHA1

439a82a699efb1868cffc011495928f14e220c0f
SHA256

5e0590ed65ea7c0520665667829c7ef3ac2689a902a8be2417f09fffd8b5d2d7
SHA512

bbafb8f5e33f5007d05889ad3d6c01671a95bde03c1ea9130443e748d1dadc4f3c2b2e92ad18879a86011561bf9915cf3aa3f105f7f53f5fa362a029546379e6
SSDEEP

196608:lSTEjLlHa692u8xIHEnykMeTwi41eHjCa61iSgJ/3nXXmFFZ:lth9+xgaM6wVmCaoiSgJfXXmFFZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1028	28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe
1028	28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1028	28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe
1028	28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe
1028	28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28d9ab7281ee136e40400a7b57d71b12_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi1E3C.tmp\InstallUI.dll

Filesize
231KB

MD5
41ee274bff9d6e806660b89c222b0574

SHA1
b1f5c6278ee3a79f3bc99c54b575877f425384a5

SHA256
2e0efc40796ba393b33f85426533135274e9f39cb9888cc29c5d49db754a83cc

SHA512
d2a1c9e23df48477577d27cd6c012017a8a19914e786c0774ae3c4ad4cd9628ec907e518d4dfc8d5ecfdee7671913a16d2dbe690064c9c768b32d86c796628cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi1E3C.tmp\skin\main.xml

Filesize
5KB

MD5
931e0fbf7e7f99b52e74a4cea5f0a04e

SHA1
f33d282481b4b7ea3f0487fbf04043215700bd15

SHA256
947a7b9fe2cca143678233573de931f365aecaee69f7c4f25fc7cd90e3efa423

SHA512
19b485dfa1af984aa4d956a723c7d7aac74ff8217d009b604a6cf453868c1945a64f6e51ae5ce3139adb844c95d95eb69d4871f2d9acc9aca9b2f4a650b116ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi1E3C.tmp\skin\option_check.png

Filesize
1KB

MD5
c5bd9bcba968c36dd66c166dbf97d5e8

SHA1
a0a14979b0211a08c6628540455a10a3c031cfa5

SHA256
24f2ba188c1592e35370d04db0f049672fc0141290df130ea2ba38dbe6f7fe77

SHA512
fcb6bf59a8fecade948977e4d54f29d22ed6bc777c6dfb68fc23782de6e7035df55cbb204f8432e9141b0fdbc90c9ae8c9df1288c7b3d530147206817a2f1182

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1E3C.tmp\System.dll

Filesize
11KB

MD5
959ea64598b9a3e494c00e8fa793be7e

SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0

SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

Download Submit
memory/1028-31-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/1028-83-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download