0699a6a94d99b68a35592c563b41abd7c5fac6af9f0c076a98be92359df05a74

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afea3c7156fd9faf03fa0da1fec5544e_JaffaCakes118.exe
Size

341KB
MD5

afea3c7156fd9faf03fa0da1fec5544e
SHA1

5f90760d014b28b31ab61e106a6da24bd834bde2
SHA256

0699a6a94d99b68a35592c563b41abd7c5fac6af9f0c076a98be92359df05a74
SHA512

097bd226c7e504006ed4849a4c7a24c546e38eb9fab4971bee68c24fe84b4a7b2a0cc98640190864a16c19f89efd8592bb6029d3a98ca9b7c9a620e7bf4a7ac1
SSDEEP

6144:cbUTp1U2GuEiQd2wxM+eB6KEzRa3pPBkf6qX6VPfs+InXh4ko:cIEriPbcbRHf6qX6Vfs+IXc

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2336	afea3c7156fd9faf03fa0da1fec5544e_JaffaCakes118.exe
2336	afea3c7156fd9faf03fa0da1fec5544e_JaffaCakes118.exe
2336	afea3c7156fd9faf03fa0da1fec5544e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\afea3c7156fd9faf03fa0da1fec5544e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\afea3c7156fd9faf03fa0da1fec5544e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsm4CB9.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm4CB9.tmp\TBC.dll

Filesize
94KB

MD5
ec0281fd243bffbfe3cf1558e99b51fc

SHA1
2841c1e42a06d618db54dedc9a5aee48c1c9869a

SHA256
902ce26a56b68e18f4360c7b6a3221757377af06e9125bdaeed8f1290d999659

SHA512
a117af91d786ef824f0b0f978cbc15ebc098f6b57481888d97f0ce503ce39e4a6312cd51ffe32625cbe8c4d019f5b40a4d796608c22eeb95d97150c57080d99c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm4CB9.tmp\nsDialogs.dll

Filesize
156KB

MD5
879ef35b34de9a94762cb32d26ae0db5

SHA1
a9754a70d9456d7b4292a67d44ccf53757ed70ce

SHA256
51480849fec0b57b872a9bf6992f8c98e6ceb79b318b09a48347f6d3e0bc416f

SHA512
9b373b04fdeef8b9f1cbdd7bf412990422497e437ae6fd0bcbe8ae7f8cf343161f4be200b3207960884c09558175157764f9af688c0cac53119db3ceff980ee2

Download Submit
memory/2336-18-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download