Analysis

  • max time kernel
    92s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 12:06

General

  • Target

    91b9cc02b2a3dde4f8f54ba3646c2cc2_JaffaCakes118.exe

  • Size

    23.2MB

  • MD5

    91b9cc02b2a3dde4f8f54ba3646c2cc2

  • SHA1

    998c7d61234a3cb6c70bf3735d9353ce53c19b1c

  • SHA256

    8fdbf2e7885aed7b918d92f0e1def1d4e441d454950c557f154019fc344abda2

  • SHA512

    193308f7e1de3b469aa92a01696fa8123f9d73536fa721bccfb334299006636e9d2e875dfb257da7efe770a7edf5efa3da29c0cc52e2adba3ff37c8044dbaf47

  • SSDEEP

    393216:3QikroXyHYAbwDDyMTtOD3vW0J0NUrWQ4jmskmJONvTo3ofrzRUt3f9SNu8q8l:3xkW6YAbwjtOD3vWXNUNe9i8YTzRfNxh

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\91b9cc02b2a3dde4f8f54ba3646c2cc2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\91b9cc02b2a3dde4f8f54ba3646c2cc2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    PID:548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsp2C70.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    20f3184efe7edddfef3325efc25d12a5

    SHA1

    8db4c500d73f9525a7e9834df6caea2e70189939

    SHA256

    0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

    SHA512

    433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

  • C:\Users\Admin\AppData\Local\Temp\nsp2C70.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    ea60c7bd5edd6048601729bd31362c16

    SHA1

    6e6919d969eb61a141595014395b6c3f44139073

    SHA256

    4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    SHA512

    f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

  • C:\Users\Admin\AppData\Local\Temp\nsp2C70.tmp\advsplash.dll

    Filesize

    5KB

    MD5

    669030d7919ae29999a2fd89aa427202

    SHA1

    870bcb7e87bbf423abcbc1c5be80f7e63720a6d8

    SHA256

    e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82

    SHA512

    1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f

  • C:\Users\Admin\AppData\Local\Temp\nsp2C70.tmp\ioSpecial.ini

    Filesize

    831B

    MD5

    e204db5e6209bcfd7d8d2225b71f79b7

    SHA1

    bba79b28ce5e69f9f77615b7a2096136e0d07ef4

    SHA256

    9b031af988fbac886b3c3bc225b5ded4f1c398d29995b68365ab9f461cc9f532

    SHA512

    7413523c3c37b16058b653aabffe1ee6343070f635cae2a744d460dddd271f2bafacf1d85434a5f8c8517a382aa5ac297c90c2a9c026b30ec2d04ae885d0c9a1