f57db99dc4f275e80dfbec38e0e02bc0e1203077692ef23205ee435bd94cf5e2

Analysis

max time kernel
132s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:21

Target

6856645a776c6f1afbe2ab1d43da38ba_JaffaCakes118.exe
Size

299KB
MD5

6856645a776c6f1afbe2ab1d43da38ba
SHA1

3009dd5b8629ba9fa7310385df4cc560898a90ba
SHA256

f57db99dc4f275e80dfbec38e0e02bc0e1203077692ef23205ee435bd94cf5e2
SHA512

0ab4f9b838ae4741012b2ae468954055194ad91f89040eeef169f1cd403680a1d0d19ca9303e9289600eafe89c8701cc6f7c81a33171698fea6fb5872740c1a1
SSDEEP

3072:dgxI+xKQaIWoXJ+wbebnCP8IIIMAIAw4c8E8Qr2o400wEQEoAcEgkMU4ko0wMIYy:dg1KQjoS82FyvdvT+q1g2AFwSE

Score

4^/10

Loads dropped DLL 3 IoCs

Processes:

6856645a776c6f1afbe2ab1d43da38ba_JaffaCakes118.exe

pid	process
2608	6856645a776c6f1afbe2ab1d43da38ba_JaffaCakes118.exe
2608	6856645a776c6f1afbe2ab1d43da38ba_JaffaCakes118.exe
2608	6856645a776c6f1afbe2ab1d43da38ba_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\6856645a776c6f1afbe2ab1d43da38ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6856645a776c6f1afbe2ab1d43da38ba_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:2608

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsp4538.tmp\InstallOptions.dll

Filesize
14KB

MD5
2a03c4a7ac5ee5e0e0a683949f70971b

SHA1
3bd9877caaea4804c0400420494ad1143179dcec

SHA256
d4f0042d8e7622b7e14395e926dd02edab3cdc77e82d88108b67a4d2cee9229b

SHA512
1942cdb522859f8dba46824786e361794a62e6201279201e1e0e2e07499fb6252933c5661782fccd77291c3650cafb2a7a08eee5431c8238f0da44840ee4c476

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp4538.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp4538.tmp\codec_settings.ini

Filesize
1KB

MD5
a555549f28022ce5b4d552acf2ee6797

SHA1
2ca01b4b6db7c87ef1624dc3e9c76c34bba8629a

SHA256
5930b64fe05f31dbd1be73fc15e319b96b8b696b111157992d478c67546fa584

SHA512
550bd0164fcda382b360db52115170c898f61026a9a0fabb42cdd09a609c089fdba5646c381fd8ffc25240515eab1e1c425a974851a383c7b884a7d3dd1f21a3

Download Submit