07139c63bd2771007c5512ac1ebe7bdbe8d1f2ee1fede3d84d3db914a8c04b76

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe
Size

98KB
MD5

603c6fba2e972d48f06167fdd6d43b26
SHA1

adad90ad84e4a6877b1d7877a5292e63aeac12fe
SHA256

07139c63bd2771007c5512ac1ebe7bdbe8d1f2ee1fede3d84d3db914a8c04b76
SHA512

ce665cbf33647b1fa90171a38bb5faff3e2af2c3fb5090fdd8efbf6c612908407d0c8b01d85f88599c0c7c202720aff1d3ccb47d703f1e8cb3fa67d4e88c5871
SSDEEP

1536:akbyLlCFPVxFyEYWCFEAVcOnpP/C32EdH/IlU7PPhGzCgLh3Tv0ZghJ:DyLl0VxEEYFEucOnpHW2EIl6GXLh370e

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1072	603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe
1072	603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SimplestSetup\3	603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe
File created	C:\Program Files (x86)\SimplestSetup\SimplestSetup.exe	603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe
File created	C:\Program Files (x86)\SimplestSetup\bcg.bmp	603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe
File created	C:\Program Files (x86)\SimplestSetup\logo.bmp	603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\603c6fba2e972d48f06167fdd6d43b26_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu39DE.tmp\inetc.dll

Filesize
21KB

MD5
92ec4dd8c0ddd8c4305ae1684ab65fb0

SHA1
d850013d582a62e502942f0dd282cc0c29c4310e

SHA256
5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934

SHA512
581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651

Download Submit