128c7acb8d2cb842afcbe6bd73e951be139f1d9c760bfa81c08625ee4fcf5518

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe
Size 666KB
Sample240603-vfbqhsch51
SHA256 128c7acb8d2cb842afcbe6bd73e951be139f1d9c760bfa81c08625ee4fcf5518
MD5 92843471434ce36f688d7e80fc532df2
SHA1 689b574d33691b2e10a54ed08815935b202bf43f
SHA512 e8f286b2c7a0c7a798c608ab5e07772f9dc66e73cdea3b87e49e01de85f725535e4dc5abcefde8eddc6a140a0f03e720c714aa0029d90f34e6a91e17126aa851
SSDEEP 12288:4Ew0uF7YCUzFZiJ7TkZwYcwXUT6gQhEZj9k/IXu0JRGCM:4f76zq7gZZcwXRDhEo2ukECM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
600	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe
600	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe
600	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe
600	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe
600	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
600	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe
600	92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92843471434ce36f688d7e80fc532df2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nst441F.tmp\LangDLL.dll
Size 5KB
SHA256 47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
MD5 a1cd3f159ef78d9ace162f067b544fd9
SHA1 72671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA512 ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
SSDEEP 48:apTVWFeApYx2lxaKe3yfeEIWCGWNpBWLGGrx3pMt4z8mtJ7HofYZVSLa:RFG0xaKkyfjIWTW7BYrhSbmtJ7/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst441F.tmp\System.dll
Size 11KB
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

__ea8640c5926445e9a009f56b3951c44b_lib.dll

Path C:\Users\Admin\AppData\Local\Temp\nst441F.tmp\__ea8640c5926445e9a009f56b3951c44b_lib.dll
Size 708KB
SHA256 dcf08a1cc39947e88969b717254f1dcb8b9f9787b3f43e0bfeb06cab39f3dc71
MD5 a739eb5eaa5cf8c8234450bc7d67fc37
SHA1 f45ba077c726d37ac7a8ee878bd0902d24dfe1ba
SHA512 5e3c3a45c40bd1d6f8e2700b640339ef428a3ae22ee3366ef6760acd01c1738f7987da9db1587445df12508122ef04c4f26d23bb5eb1aad83bbaed3fdee607c5
SSDEEP 12288:IiqgOcsDRSOSwADny14g7UFPb6CmW2KBrBMOd/13bYSBAVOvgiJns5QSkWKwwBLj:IiycstSpDLaYFP+iPBA0oiJniQSUxmDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

__ea8640c5926445e9a009f56b3951c44b_vlib.dll

Path C:\Users\Admin\AppData\Local\Temp\nst441F.tmp\__ea8640c5926445e9a009f56b3951c44b_vlib.dll
Size 295KB
SHA256 9dc8817d4f9a3c2a843ddabe8acfb6fee7897bf49dbe6e6ba3c7b1e56552ad85
MD5 7105dd0491f34f257cca14e3de599fd3
SHA1 e47c9d036197ef570d97fe51e2276b37b2b01cc1
SHA512 fefaa1b06971576c9ec4e122541f8c97cf3dcc6804626e95432bba2288528e40c24444dda6aad0d5146bba67bd64732427399742eecb79c021ed38087b63931b
SSDEEP 3072:5IuZetOHA8FlkEzsnDp4kEjDxjU4L1qEqwac8frFhz0XYfFiP6ss3n6xQDy1tjY7:513mykEj1j/qED8tfF4dgkEVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nst441F.tmp\nsDialogs.dll
Size 9KB
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads