110578f07764b3635afe1843828987aed1213f4b14d9bfda1d6139a63bcad93d

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
Size 301KB
Sample240614-d1d8psxdpm
SHA256 110578f07764b3635afe1843828987aed1213f4b14d9bfda1d6139a63bcad93d
MD5 a7da076cd4ee0e902c14b4e83d381738
SHA1 cd41e7513de4f89129f89469921e4b7ef609d901
SHA512 41bf3324ed186543619869120a035003cdf34c693718fec806451a4be7ef44c8528e63ebf2d135337f07489ab9c2b956bf638da318ab97c31d7af65d7009da23
SSDEEP 6144:6zfj/8xGSIVKNIvCbXJcOalNF3WvQzwRNh4VcI9yEP7M:w/8bWacNDURTI9yE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 29 IoCs

pid	Process
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
60	a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7da076cd4ee0e902c14b4e83d381738_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WmiInspector.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdF30D.tmp\WmiInspector.dll
Size 104KB
SHA256 a9347413de4b0f90cac0b5e300cec9c867bdb28bd7a60d07b10fd31ee56c60cb
MD5 8531346d16fa5d4768f6530d2eb2b65c
SHA1 153601d36aa0ddfbc597b1e890917364878791ca
SHA512 f214e75de20edeb7eece02659fd7dafc8c3d63c2350c58825bc6e9ce0b73237962d8273b4bc803a2f304cee9f9cad1cd4edab28322c1e678bc25eb88faa6a841
SSDEEP 1536:V8FVCqSrlWzXRaGDejG4jsenxiqIjF3/BWBk7/lU6wt1bA:OaqSr4XkGuxny93Vwt1bA
MD5 SHA1 SHA512 SSDEEP

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdF30D.tmp\inetc.dll
Size 20KB
SHA256 096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
MD5 f02155fa3e59a8fc48a74a236b2bb42e
SHA1 6d76ee8f86fb29f3352c9546250d940f1a476fb8
SHA512 8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399
SSDEEP 384:voJLJVqG5WLJgu/Emx1Ywxd2ZmX66vwUhU7ya4LC0Ac9khYLMkIX0+Gv8gcLom7:AJVkN8mHYwxdWmX3wUhUua4LeT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

t1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdF30D.tmp\t1.dll
Size 4KB
SHA256 510af8083c0eef8b04e1171a9d6d94c64a1859701bbb106c565d2ec869437661
MD5 058ba8a0916d957d3b91d08ea2e876e2
SHA1 1a7c36c50c5bd93f535b624a2882bc3905e7e7f3
SHA512 24124b45bf42e186a06fcb71ca7e2c1fed3b762b681286185d7cdff53b3800c35b6326a6f21c82e9de59d8bbcb3fdab4a5c1cc9c8683e43ff230b07913d26f02
SSDEEP 48:a/1/wEVQWsasy/372nPbws6KcSCcqGTN5gXwvl9g6P:81/wise/37upcpcqGh5gs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads