6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 17:39

Target

76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
Size

15.8MB
MD5

76468fca3a1a12f2a7852162bd7bc7d0
SHA1

d439bfee804626bcf987cf4f8a1d9cec3abf9fec
SHA256

6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a
SHA512

c4608fa71abf1cd7d287e706890df7ce89312af0cde18c00e4dbc0f6f9aa6bccf9323ac975ac520769f6353eb634127214f7122fecacde6ace8dd1adcf7c5d0a
SSDEEP

393216:Jah5U+kSRi+EeHy6VvG9pUKFSb4l8a+0RvGSdHUUMD2:MASJVe9pN6sb5vGwUDC

Score

7^/10

Loads dropped DLL 2 IoCs

Processes:

76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe

pid process

1044 76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
1044 76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe

pid process

1044 76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe

pid	process
1044	76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
1044	76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe

pid	process
1044	76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nsoE35.tmp\ioSpecial.ini
Filesize
670B

MD5
94dcf6bc8b44d80f7ad9aecb665e19f2

SHA1
b307bba7d80dddb1225c5b487efa7c536e7954ce

SHA256
8987f10f77ff0471234379008c063542bf719b747e0ca7d1a1dc875db02579f6

SHA512
c18f3cc7be2179e0e2ac1a696e5f68cdac91e09ed95dee0766d04ce4e52d5d337e643abcab766170e8e93fd40bf1d234e87b730f971dd82182afed0451873060

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE35.tmp\InstallOptions.dll
Filesize
14KB

MD5
714e0ecd29f9ec555f350f38672726c7

SHA1
555b1492e782d7a30f280f2aecb64c642c1aaad3

SHA256
21fea4cf18de8e25d0ffa3375699150fcd04e6d470358696f2dffdd3fc09d7f3

SHA512
ced5814f25b688d1ede5a1395bcca69e1a0cba260104f156dc03de6ebb2015f6d832fed86ac234c36a10a75be33f489a63c8bd6111e3aaf4b078af1d94b00312

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE35.tmp\System.dll
Filesize
11KB

MD5
960a5c48e25cf2bca332e74e11d825c9

SHA1
da35c6816ace5daf4c6c1d57b93b09a82ecdc876

SHA256
484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

SHA512
cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

Download Submit