Analysis

  • max time kernel
    141s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 10:05

General

  • Target

    7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe

  • Size

    23.2MB

  • MD5

    7199ac1b490ee536471c6c613fd9a170

  • SHA1

    7004cff9c2143ad1af170adbd43f5977b8c4872a

  • SHA256

    a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649

  • SHA512

    4ebc3fd9648f91acbec0272d9cdb393b6d988c4441ebb60a0d9b7430b268f826f730ed1e0094b28dc68eeec56a8570c64ab8fbc40485fd50e476f73e22fb9b18

  • SSDEEP

    393216:9rX2hFm5Aes/9wDDyMTtOSufUD+Lk0QRQAm5EUymJONvTo3ofrzRUt3f9SNu8q8d:9b2EAwjtOjfM0QHmNXi8YTzRfNxTd

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    PID:1260
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4396

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\InstallOptions.dll

      Filesize

      14KB

      MD5

      20f3184efe7edddfef3325efc25d12a5

      SHA1

      8db4c500d73f9525a7e9834df6caea2e70189939

      SHA256

      0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

      SHA512

      433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

    • C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\LangDLL.dll

      Filesize

      5KB

      MD5

      ea60c7bd5edd6048601729bd31362c16

      SHA1

      6e6919d969eb61a141595014395b6c3f44139073

      SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

      SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\advsplash.dll

      Filesize

      5KB

      MD5

      669030d7919ae29999a2fd89aa427202

      SHA1

      870bcb7e87bbf423abcbc1c5be80f7e63720a6d8

      SHA256

      e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82

      SHA512

      1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f

    • C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\ioSpecial.ini

      Filesize

      831B

      MD5

      e03d1a410152c16bbc05fa360648c215

      SHA1

      a7140590f201ae8cb46a3d7ed8bdb6aa33726605

      SHA256

      ac9a01a3965e2cb8a6526be3d8d67bcf193d5ef36ec875a73478a1e85ba9c81d

      SHA512

      ea7ce083fc9e72f4ad4b76e54a6e89808364651c763d6f1aacd3a183aedc4aebdd90763238f71f4615ae941e0a3ca61368eb1bcc73ba91d3a6b9c0661c98688e