a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
Size

23.2MB
MD5

7199ac1b490ee536471c6c613fd9a170
SHA1

7004cff9c2143ad1af170adbd43f5977b8c4872a
SHA256

a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649
SHA512

4ebc3fd9648f91acbec0272d9cdb393b6d988c4441ebb60a0d9b7430b268f826f730ed1e0094b28dc68eeec56a8570c64ab8fbc40485fd50e476f73e22fb9b18
SSDEEP

393216:9rX2hFm5Aes/9wDDyMTtOSufUD+Lk0QRQAm5EUymJONvTo3ofrzRUt3f9SNu8q8d:9b2EAwjtOjfM0QHmNXi8YTzRfNxTd

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1260	7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
1260	7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
1260	7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7199ac1b490ee536471c6c613fd9a170_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\InstallOptions.dll

Filesize
14KB

MD5
20f3184efe7edddfef3325efc25d12a5

SHA1
8db4c500d73f9525a7e9834df6caea2e70189939

SHA256
0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

SHA512
433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\LangDLL.dll

Filesize
5KB

MD5
ea60c7bd5edd6048601729bd31362c16

SHA1
6e6919d969eb61a141595014395b6c3f44139073

SHA256
4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

SHA512
f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\advsplash.dll

Filesize
5KB

MD5
669030d7919ae29999a2fd89aa427202

SHA1
870bcb7e87bbf423abcbc1c5be80f7e63720a6d8

SHA256
e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82

SHA512
1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk2DE2.tmp\ioSpecial.ini

Filesize
831B

MD5
e03d1a410152c16bbc05fa360648c215

SHA1
a7140590f201ae8cb46a3d7ed8bdb6aa33726605

SHA256
ac9a01a3965e2cb8a6526be3d8d67bcf193d5ef36ec875a73478a1e85ba9c81d

SHA512
ea7ce083fc9e72f4ad4b76e54a6e89808364651c763d6f1aacd3a183aedc4aebdd90763238f71f4615ae941e0a3ca61368eb1bcc73ba91d3a6b9c0661c98688e

Download Submit