331c4b65cc3859aabcf21d012e8e7e89ae68a591de66e1b61064b3263694ebe1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c0231eb508e6f8ad60288a61b4212c4_JaffaCakes118.exe
Size 9.9MB
Sample240528-g7a2eahc5y
SHA256 331c4b65cc3859aabcf21d012e8e7e89ae68a591de66e1b61064b3263694ebe1
MD5 7c0231eb508e6f8ad60288a61b4212c4
SHA1 4150458566dab48108535f3a32e6ffe4f1a2a92c
SHA512 05c623a3529c98fb2badebf627d06d019010b475415670d37e4545cdffa23912a20a321f47d555c2e39c837211b33c129662767ed287921af8b4b8db8484f9de
SSDEEP 196608:uYSpn6L1iqCTZV2AopAVzPtDaRyry6DG/eik/anX7+Jol1LnAP6XVh:HU6L1wDFomBi6y6imV5JWhE6XVh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2876	7c0231eb508e6f8ad60288a61b4212c4_JaffaCakes118.exe
2876	7c0231eb508e6f8ad60288a61b4212c4_JaffaCakes118.exe
2876	7c0231eb508e6f8ad60288a61b4212c4_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	7c0231eb508e6f8ad60288a61b4212c4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7c0231eb508e6f8ad60288a61b4212c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7c0231eb508e6f8ad60288a61b4212c4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst257C.tmp\ioSpecial.ini
Size 683B
SHA256 86a463e3e753cc3d2a8fabe349ed85189044be278cd4873e6fa89ca13b5074bf
MD5 7fc05215103afd74a22ea185d9ec44a2
SHA1 0d979090965c6a0f435aab3c325adb7d19b6e4e5
SHA512 d1996b6359f02b727b15eb7c6381e4dfd667671798e10d8af9281e365e2944d5d88f14284b9362c8f62e5c39e175fbc317fa9139b6e68c3656be34d4c88f623f
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst257C.tmp\ioSpecial.ini
Size 696B
SHA256 99dadb174bbd97ab471f2c443daee698b9973e7d8925f218e649be6ff97ae894
MD5 de56f5d80abd55b4856b7d81858d6b4f
SHA1 44f1ad0dc3bf39baa5668d13718be4639070c50c
SHA512 e5ea234d849a66a5e839db941697937f927d1be22b2e22b481b65e586468cc2b89fed59af2bc22316632dacced5fe612aa8dbcd62c54d35c898af952b2326ca0
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nst257C.tmp\InstallOptions.dll
Size 14KB
SHA256 78012f560bb917218435f4b3ef2e3491bab15647e11ccb90bc117731181134c4
MD5 5d195f1ac9869c208f6c02a5bde6f9c1
SHA1 a8ec993a12708572ca8ca3d1fcbdc25230bdaf10
SHA512 1f6a2e909e3a7188f24758715cdc7c9d8c17450a67c37cc74487924b00d5402c125ff8ec27b42038e20b560016f086b05133bf2bd04e670a1c46fa38c1b20672
SSDEEP 192:C4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjYK72dwF7dBOne:jn3T5KdHCMRD/R1cOnrjY+BO
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path \Users\Admin\AppData\Local\Temp\nst257C.tmp\UserInfo.dll
Size 4KB
SHA256 11adf8916947b5a20a071b494fa034cf62769dcc6293a1340b29a5bb29ac8e87
MD5 7836f464ae0102452e94a363b491b759
SHA1 59909a48448b99e2eb9cd336d81d60764da59f31
SHA512 5ed63eefa1b3b3caad4cb762ccb8419c05bcad3da3a7415235cda2d2a1f79eb018503ca30a0a92d6b72160327decea9a70c48e0c28de94dd67303d4aea4a02db
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads