0c860b7f821fc9d1ac0d91410201743febcf459b95c848529a8f816a9309a240

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe
Size 5.1MB
Sample240612-2t4f1stfmg
SHA256 0c860b7f821fc9d1ac0d91410201743febcf459b95c848529a8f816a9309a240
MD5 a2cccb3b153e379be1097784004c5d6f
SHA1 fcbba87da7b228135b1a3a9e184000978011936a
SHA512 0c2da50ea3cea93d17534d8dd98ae5b876bdc3df2d0fe2640a1ef2b4c610a654677cf0a62882d29e3b2c81054e4f198d02ec5cc7384ee896783c6b961da1b7f3
SSDEEP 98304:xu0kEKAi/8Zb9xrNCclVIx83sLzaKVRVdlgDMxZYL7fT1GbDSf/i:c0DZRZb3IE8LeKV3dltqfbGgq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1912	a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe
1912	a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe
1912	a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe
1912	a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2cccb3b153e379be1097784004c5d6f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsiC41.tmp\ioSpecial.ini
Size 612B
SHA256 9e9f776b4a3f488859a697750c0fc7c80586c1b3a20adda8c8477dcb3e17255b
MD5 03c3ea375989132cd9dec297fb487a27
SHA1 72df2a934464b008aa0a31284b58f810d36ad9aa
SHA512 164c8d259eb2b4a0f4c7991aa0bf475e76a3340c7e6b63cb3afe8ea3ec8297aaafc9e44bf813a05671095ab248a6088e5e02959b9685595b535f9dd0ae6081ed
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nsiC41.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path \Users\Admin\AppData\Local\Temp\nsiC41.tmp\UAC.dll
Size 13KB
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path \Users\Admin\AppData\Local\Temp\nsiC41.tmp\nsProcess.dll
Size 4KB
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

Submit Download