258c0e5c6484aebc3249f400e144c323af084e637c197237e16427d8f7a078fa

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe
Size 31.7MB
Sample240611-2bd4eatgrm
SHA256 258c0e5c6484aebc3249f400e144c323af084e637c197237e16427d8f7a078fa
MD5 9fbc18bca1d2055175ae8702ea28331e
SHA1 064d141653d61deb2a9169ba2e3689af1a27810b
SHA512 1123cb7f2249ea879fa99320d9a5ff1ff73138050b898669afc2087302a05ce9297d4e6864d9203d319b64d4308f15f785383e8090083d9209690a99370f3319
SSDEEP 393216:/TFkbpiePvYaJfQhn8tofI6QYyCWUeAPvkY9Ko0lH7p492TPMIuezL/ragOrUot+:LFkNJPZxc8to9NFvZ6jDTBBzLWgEK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3380	9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe
3380	9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe
3380	9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe
3380	9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3380	9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe
3380	9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe
3380	9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9fbc18bca1d2055175ae8702ea28331e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ico_choose.png

Path C:\Users\Admin\AppData\Local\Temp\nsx5A47.tmp\icon\skin\ico_choose.png
Size 1KB
SHA256 2c8ddebe64d8bff891f8151ae547bf229447538a332dc146d1381725b5aa756f
MD5 5551407be2f5b33b243ed498a7edabe6
SHA1 df1b426bf0bf0a9120139f9c51d203cc49ed044d
SHA512 f8196dc1c5875f50dc7caddd5977b1b0d88594e6a597235d67c1aad772305ccf814cb2575876a9556babb54629fbaf4e575c3b83d501654376c65098a5d4fd50
MD5 SHA1 SHA512

Submit Download

skin.xml

Path C:\Users\Admin\AppData\Local\Temp\nsx5A47.tmp\icon\skin\skin.xml
Size 2KB
SHA256 3ea919136ffbb5246366b569432517d834d04c5531012ccba8287f381d66d946
MD5 110caed05e2c3dc70c5db074bdad1fc4
SHA1 8393f39a428eb582178b643a54750cc8f9a3c425
SHA512 41d81cf1cec35f8ff4d1c5e6bf1b4850b70a7588ac0585af37cb8a04757bdbdbb67a3e7c9b31a1e463413878f0d35264314409de0377ca6c04cccb4bcd1e1c36
MD5 SHA1 SHA512

Submit Download

nSisImage.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx5A47.tmp\nSisImage.dll
Size 2.5MB
SHA256 4fed7843478a38943d74b80278505d1163ebdbb40104f4025d89bffc20549355
MD5 ac7824a2973f76da53ad47ce478731c1
SHA1 28ff72686325e8ea473ed487c5e31e74c896a877
SHA512 b8bb6dbfb7c9b99e2b20d0642ef7f1aee01af55a6671db1a7bfb0cd77baaa233d30170ecf0b57303a3e3f8a86c45f46ca7e95c011bab80918eefce268f1a2b4e
SSDEEP 49152:/OqdbbETJCKYCmnCx+V76aDomhJeeRVwJP13tQ+3SjnPzuTajg8xYpcvFlpVxf3b:/Nd8TJCKYCmnCoV761mhJeeRVwJP13tw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads