6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a

Analysis

max time kernel
133s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 17:39

Target

76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
Size

15.8MB
MD5

76468fca3a1a12f2a7852162bd7bc7d0
SHA1

d439bfee804626bcf987cf4f8a1d9cec3abf9fec
SHA256

6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a
SHA512

c4608fa71abf1cd7d287e706890df7ce89312af0cde18c00e4dbc0f6f9aa6bccf9323ac975ac520769f6353eb634127214f7122fecacde6ace8dd1adcf7c5d0a
SSDEEP

393216:Jah5U+kSRi+EeHy6VvG9pUKFSb4l8a+0RvGSdHUUMD2:MASJVe9pN6sb5vGwUDC

Score

7^/10

Loads dropped DLL 3 IoCs

Processes:

76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe

pid	process
3488	76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
3488	76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
3488	76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\76468fca3a1a12f2a7852162bd7bc7d0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4292,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
1⤵
PID:4600

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nsqECB3.tmp\InstallOptions.dll
Filesize
14KB

MD5
714e0ecd29f9ec555f350f38672726c7

SHA1
555b1492e782d7a30f280f2aecb64c642c1aaad3

SHA256
21fea4cf18de8e25d0ffa3375699150fcd04e6d470358696f2dffdd3fc09d7f3

SHA512
ced5814f25b688d1ede5a1395bcca69e1a0cba260104f156dc03de6ebb2015f6d832fed86ac234c36a10a75be33f489a63c8bd6111e3aaf4b078af1d94b00312

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqECB3.tmp\System.dll
Filesize
11KB

MD5
960a5c48e25cf2bca332e74e11d825c9

SHA1
da35c6816ace5daf4c6c1d57b93b09a82ecdc876

SHA256
484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2

SHA512
cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqECB3.tmp\ioSpecial.ini
Filesize
671B

MD5
6de60ec44b093820074d14e4c7ca1f7d

SHA1
1ea1a8be51ab5aa9d36b822a85b6d5b8f9d2af3b

SHA256
31c84400257e6cd6a7d686c0f733aa05f25dbfbcf53b3c9af5267e952ef9915c

SHA512
b681bb5925d0d03f803cd8ae11d0a250fd647dbf4695e12e8a246ec31150a745ce8590a96fb4497d84bfbced770536d2abce6f41036a4a5422fee08e3f5cf945

Download Submit