cb6bb334e15093e624d5a39cac6e119515bc961ea5a1232ab4aa1f6930f21584

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

768be2bb7696ac531c86239484e01d01_JaffaCakes118.exe
Size

14.9MB
MD5

768be2bb7696ac531c86239484e01d01
SHA1

f6cb62a4d3b032f4fa4b7aefd2b10a2bbc61d8a7
SHA256

cb6bb334e15093e624d5a39cac6e119515bc961ea5a1232ab4aa1f6930f21584
SHA512

680f0db56f418999f18421a420d12385fb9d203da5daf0877cd9e1134fbf7d8c29229ddf173dcf6e06f49d62c91ad5581a914f705d090374c4ace31421b42c38
SSDEEP

393216:lLCpCbVuqCiV4WZGLyvqIWIaCu6EyL79Iidj3XEIH:9Sy7CyxZnqIj3u6t9bR30IH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2020	768be2bb7696ac531c86239484e01d01_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2020	768be2bb7696ac531c86239484e01d01_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\768be2bb7696ac531c86239484e01d01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\768be2bb7696ac531c86239484e01d01_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy6BAF.tmp\ioSpecial.ini

Filesize
714B

MD5
7183642b861c1c95f4b5e0b043949ce1

SHA1
2e96b4444e9b6f10e48baf1a23175f4e6cdd161b

SHA256
0ca8ea4d7133d5c2dc6853080a2c8ddb17aa06a992395e9228160193494d613e

SHA512
8d60fa4bbc217988415bcd0e777c97e4cf3502a29945090e1ace4f9eb0c2536149d55f161652f0f84c1f39719887968cced1cf6d2324b76e0a4cea59eb30a839

Download Submit
\Users\Admin\AppData\Local\Temp\nsy6BAF.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit