Overview

overview

4

Static

static

3

2fb85bb9f2...18.exe

windows7-x64

4

2fb85bb9f2...18.exe

windows10-2004-x64

4

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

TooltabExtension.dll

windows7-x64

1

TooltabExtension.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    133s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 15:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2fb85bb9f28d0e4ffdc25373d62bb5af_JaffaCakes118.exe

  • Size

    375KB

  • MD5

    2fb85bb9f28d0e4ffdc25373d62bb5af

  • SHA1

    246913dda1e64699b84072b66a8ac6a615352a2c

  • SHA256

    5c20f787d65581858cad42a613de5ac25c4f08d240d7af4a23bc3769042df3e1

  • SHA512

    a030695b462f787e4a72b4943a4ce3a4a52d1278822daf902fb2e44f939e3f62c67705ebaacd851d24fe11506f4c5ec999ae86a90b99293bc90b8e4417af6bbe

  • SSDEEP

    6144:zbUTp1NwKX+4DEvX1KuM+zsT8qEJEbrPBj3AfoSPoi3vCdWYDbHIae+0U/aM4tpH:zI9wQ+K61KmJ2aw8o+asspeuSLp5iefv

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fb85bb9f28d0e4ffdc25373d62bb5af_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2fb85bb9f28d0e4ffdc25373d62bb5af_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:1820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsd689E.tmp\System.dll
    Filesize

    11KB

    MD5

    7399323923e3946fe9140132ac388132

    SHA1

    728257d06c452449b1241769b459f091aabcffc5

    SHA256

    5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

    SHA512

    d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsd689E.tmp\nsDialogs.dll
    Filesize

    182KB

    MD5

    b9a5a272154fc0dd652ef9c59c5d63a0

    SHA1

    a5c72fd5e6080ce7ee8377240f5ced5e908a80af

    SHA256

    d84d810b8f8819f4a34d5e033b72951eadda1bbb5ed0b8c76874b6c25001caa9

    SHA512

    1a641c3acb32145431ad51dcbc7bcb5da532ac0fc68ea5b24f588611648dd5cae2bd197c09d5783a03bdcdac73e9ca7b07d646e6fe56903439355cc1fd4007dd

    Download Submit

  • memory/1820-9-0x0000000002840000-0x0000000002841000-memory.dmp

    Filesize

    4KB

    Download