21933cb7659d0b59ecb8c4617099577b53659e11094b205e4e90ad9f544fdbcb

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 04:25

Target

448556f37603ce1006ca67d9b43973d3_JaffaCakes118.exe
Size

574KB
MD5

448556f37603ce1006ca67d9b43973d3
SHA1

2217f26b0a2b1403bfc5ac0c55fd0ddb4efb61e2
SHA256

21933cb7659d0b59ecb8c4617099577b53659e11094b205e4e90ad9f544fdbcb
SHA512

bd2ffbd716e73d0925a358e058aa5195028c1df5810c1d21f2a6d5353cf20050c6cda99dbb51d0b462d02289ffb1113c4deb9aafe54f2655e7f32b3955cdb448
SSDEEP

12288:C+AA2Lsy+hAwopi7vB2e5hpbp1UY4DJdPw/gkBkK:CW2QvourdiY4FdI/uK

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
2072	448556f37603ce1006ca67d9b43973d3_JaffaCakes118.exe
2072	448556f37603ce1006ca67d9b43973d3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\448556f37603ce1006ca67d9b43973d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\448556f37603ce1006ca67d9b43973d3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:2072

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nsy9790.tmp\NSISdl.dll

Filesize
14KB

MD5
254f13dfd61c5b7d2119eb2550491e1d

SHA1
5083f6804ee3475f3698ab9e68611b0128e22fd6

SHA256
fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

SHA512
fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

Download Submit