76238af88d9a95bd3c17b150465d6dc8f0734d9b25670d8bd10d63559a55b615

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 06:53

Target

b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe
Size

3.0MB
MD5

b748e68c3b132a964735e64fdcdab877
SHA1

9e6e18b4368d91cbf60af4b7ab7ecb7b3d0354a5
SHA256

76238af88d9a95bd3c17b150465d6dc8f0734d9b25670d8bd10d63559a55b615
SHA512

9ddd0fd7ad0395af9147f4bec255aedb32fbfbeb9be5a9cf2952c30f9a39db46a96ea194d4166742fd942a076a1b014418b6a66c0d8ee2f1171128827fa6194b
SSDEEP

49152:sTKVqrkZt9zHRK8wHGkNmL8MzYjNJSszKUqGDbc1oODEydI+YdYl8gt:sTKVqY/9zxXwHGQmL8LSUK/p7EydI3aT

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
3776	b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe
3776	b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3776	b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe
3776	b748e68c3b132a964735e64fdcdab877_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsm32BA.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm32BA.tmp\Processes.dll

Filesize
56KB

MD5
cc0bd4f5a79107633084471dbd4af796

SHA1
09dfcf182b1493161dec8044a5234c35ee24c43a

SHA256
3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c

SHA512
67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm32BA.tmp\ioSpecial.ini

Filesize
706B

MD5
70e46e26f934490be4b56f41ba30a29a

SHA1
58b6ed03ea4f2085b06e13b57444e1afa86ef0fa

SHA256
8a8eb135570eb1d7e581a264b51dd64874b5d80a9e795398af13f776a805ac62

SHA512
0975c2b628c19f42b8dc9cd75ec465ebe58018f29939b7f9e4023b3d1f9e29d693224a8202606ffbc31946ee345f8857bcd7655651131f1ffb2892412ac03dcb

Download Submit