0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
Size

16.6MB
MD5

691f1c48f60aee01df1fe0d10e5599f8
SHA1

f557adc500c550f759d697aeca1dd0ba0eaf6c82
SHA256

0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705
SHA512

f14a0edebd52b242a5e3979fbaf19366aa7ab424a9d09fc1ff4453614b3fd8ac66b274ab2d50c47cc301ff5cf6b55a3d28409be942fca9c1f174bf24fbae3efd
SSDEEP

393216:A0a099MyS4iWrpMq0fdrSnIOETHwNcbwcLWMpksNKaXlkFXB:AUjMyhrpodrCwjRbwcTpzNXl8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe

pid	process
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe

pid	process
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
2964	691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe

pid process

2964 691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\691f1c48f60aee01df1fe0d10e5599f8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\list-bullet.bmp

Filesize
102B

MD5
8181f7cc23f912e9894979caf4a9b830

SHA1
aa2350adb503facaeef53d515767f7224b6f0908

SHA256
aaaa48e1f7c21db879f4eacfd797263436789293b5b9007ded85520f19882e39

SHA512
e7b6a251779ab3842ee96a4f5b33e6c8416887b7b5860dc49e13ddf89e695c776305d15a77d82acff495a0bcfe549d91d88fb58713b7402450c66861d9aed349

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi2712.tmp\installer_translate.ini

Filesize
252KB

MD5
88127dd4e5ff4d1e99281e2205629d68

SHA1
54666e4e573c680a032201154404c41db292d330

SHA256
2603412440b0f0ce192d238d3612f19efb99e881a2e7f1b4a5694652bba1b6e2

SHA512
bba0878d9250e7f7b9842ff259cdb2b92b241ab51b73114f33ec94f6eb9db22a41e3f5e6fe1915ce3fac447cb450c432a36c678a5369c6f2159cc91284404c18

Download Submit
\Users\Admin\AppData\Local\Temp\nsi2712.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
\Users\Admin\AppData\Local\Temp\nsi2712.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsi2712.tmp\nsDialogs.dll

Filesize
9KB

MD5
4ccc4a742d4423f2f0ed744fd9c81f63

SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc

SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

Download Submit
\Users\Admin\AppData\Local\Temp\nsi2712.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit