Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 10:56

General

  • Target

    6e44038874ba9925eb17a7e65dae99ea_JaffaCakes118.exe

  • Size

    3.0MB

  • MD5

    6e44038874ba9925eb17a7e65dae99ea

  • SHA1

    0169c3e0d6c4eb7a20609cea73ffccdfe29f1ec8

  • SHA256

    b38764ac5a035a5d3357f2c68c65a090fbd5321c1309dedf73e4f540e5500f27

  • SHA512

    9f7153012fbb60796fdf307ae5283c1e331cde2a0a3da598a86a042a9ae86aa6a7e9c0f7bc6387d8fc50ebb90c173165714ca4dccfea9380984f584fb7d5d1ed

  • SSDEEP

    49152:ow1gJ2xOZi2p1x37cn6LYznadZT/eCYZYdrCyTD0hiJKMzDnpUpjSdKp+/4lpTOJ:xuJ2IZjDemvfBQjToJHLCpjGKD0lL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e44038874ba9925eb17a7e65dae99ea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6e44038874ba9925eb17a7e65dae99ea_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy10E4.tmp\System.dll

    Filesize

    11KB

    MD5

    a436db0c473a087eb61ff5c53c34ba27

    SHA1

    65ea67e424e75f5065132b539c8b2eda88aa0506

    SHA256

    75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    SHA512

    908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

  • \Users\Admin\AppData\Local\Temp\nsy10E4.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    e75ae7cfe06ff9692d98a934f6aa2d3c

    SHA1

    d5fd4a59a39630c4693ce656bbbc0a55ede0a500

    SHA256

    1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

    SHA512

    ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b