5cf2e5620a8442bf21e3587165b5f30e21ae5bcbba3e8aa16bbdcd263de35833

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe
Size

835KB
MD5

07815776c49ad5d54b64e0ba79e379ac
SHA1

8ba827be0651c515c60d5789b3abdcdc53f1bece
SHA256

5cf2e5620a8442bf21e3587165b5f30e21ae5bcbba3e8aa16bbdcd263de35833
SHA512

9e49ac6f63fc88e732b27d3473f0767c3a91ae773c75c726256f68bb2e8dfd2a53ea1a3c2b68157afbeec493d9fce81c6f454d23a278a5c6fcb5886471c8fa0f
SSDEEP

24576:m3NTquFVQA0Af3g+EpZVrklRHKetK91ZvRPoU:AT10Arg/H1KHKetK91Zv9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2344	jp2lt.exe

Loads dropped DLL 2 IoCs

pid	Process
1580	07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe
2344	jp2lt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2344	jp2lt.exe
2344	jp2lt.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2344	1580	07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2344	1580	07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2344	1580	07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2344	1580	07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2344	1580	07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe	28
PID 1580 wrote to memory of 2344	1580	07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\jp2lt.exe
  "C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\jp2lt.exe" -litename "07815776c49ad5d54b64e0ba79e379ac_JaffaCakes118"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\Default.spk

Filesize
109KB

MD5
d234d4e66c8df098a5dc3934cc0cc71b

SHA1
3bfcca74cf4ce1d30c900a2a46a8be49a8e48911

SHA256
e8d03fa7ae11afcdd020e17141438605c3f7e4cb855ad82c744416917e0b0fae

SHA512
d78504f360752ab2cc29ffce796566e1b607f65f98f147862df3908a0bf2287198650cdb665c6c3e3559e0f659370af9b4cc5df81e63dd845ee0235b7bb7dd18

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\Puzzles\windmill.pzl

Filesize
160KB

MD5
aeb12836f211312920d767d1225aa32c

SHA1
3b90d3213e66b63071666996128ad9b12528126e

SHA256
6e2c9e3edb88259d20d8e5e64dcbcf1223b5971a272ad87f43a0a8423fb47a56

SHA512
bd29b29d3404d82d02277ad67d4f18fa5fb1daa7a28ce01ce4019bb4410b1225fc7b96d7fc13e64fd97cdf4af65946b41f6305c9a2f78b55c5c61841052ed500

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\data.pck

Filesize
11KB

MD5
810261516945f6611547d7c67883a0ca

SHA1
6c607c52277a7063acd623d2ebf8f917c9420463

SHA256
5dc5a977b099f4645ebab6271442d13457bfc7a91564700dc982b292933b574f

SHA512
0d44ad0f0cc833bfb0880008de607765e25f908d883186e153f3537e9da3d5e1594b6d4524f765a40602af591d8e82901080f8775cffd3734d57dbec1349cb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\english.lng

Filesize
17KB

MD5
5354dba4dab261ecba05b7b3b2ee1d13

SHA1
b227ebace8c2a02e50c5cddbb5589928062a33f1

SHA256
3aa42234872afe5b3861bc4929bcd58146f507c45a338eff3073db534907889a

SHA512
16089a0f4e22107330e96638481f06c9065d0fb70df016b288950185d368b8f72f216e7ac4603159d72a7035ef456c1ae5bba3e555a528a88baa989fb0a4e1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\index.ini

Filesize
87B

MD5
2fad2f383246861be5f6c0a58666cca2

SHA1
347b1f04754ec6cd559b9f4a10e2b52498e219a6

SHA256
f55ad91052ae397d552fcbff1db4b57cca453651e150286d99e2dea5de98ab78

SHA512
f6174433dede9232dd183e5e9159e950d2b650122c3709763b3e20ff47eac3f61186e9832f0c8b7ab3c75100abed01006b74b74d366c6cf7421e630c4995c952

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\lite.lng

Filesize
917B

MD5
d6a6b435d0fae8bea7cf58f9e6556918

SHA1
b0c37e4c0b389e321274a29f2ff0e6c49cc26495

SHA256
b5bf33f1e3d183ff260b925b4bfaa46871f1a0e03357ccdad8fff05b26066423

SHA512
e664794bcaccbf86f6c3d4424427a9062f6ab82d6f2dfe07a13aea3e315fa114213d445a084e8e543075f3e5a9d82c0a1f179a7c257b425fb51e7ba4016b3229

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\log.txt

Filesize
852B

MD5
a6fa184ccd36c66084243ad16e8dae71

SHA1
4f9cb3ca9b765e58b29edef1ae327b3a40436956

SHA256
c26da026dc7d9633ff0958df4fa7bda574a0526be46cddc1f23d8c6a001fa9f0

SHA512
24c47b1c2921b5a5a84fa5285bb58c43d9b3a254bcb4e4b25e2954988751932162c95d565125c9753e1e734cb20161dbac42e68919e92ba1bbe126c69d56d529

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\log.txt

Filesize
1KB

MD5
b4675ce21239091b748a53760488d3f4

SHA1
129005565339584158d6726551ad52d3ee35f4c9

SHA256
10a2e181c306ed0f45c60bbeaff1826475dbea73814ae3f63f45c0d78e74d822

SHA512
056af4261a245cccde9ccb9e21177c61d31f27daab791dd36130cc787ef85880350571ab94c80fdafb0ee62410910ecc882609b0db8fbd1676e3e40835f4e6e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\log.txt

Filesize
1KB

MD5
3b9ca447f7b606830c5d9d0f00b6f677

SHA1
34b66abf5300fc863754e925f764bb9ccdc8a239

SHA256
d097e817975a7c5a4e77e17d13f47a5e97d39359ebe44d599801b7d53f18edbe

SHA512
72a8eab720037b94f4d14065094be41c0bcfe751f3dc8030db0036ee9608b71b932d317b8d0c62fa2f8c209574bf8556609ccf218d3985e66550533944849223

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\log.txt

Filesize
2KB

MD5
2c0a3e1d181bb594443bb6eb29ade6cd

SHA1
4232a0d3067ec1258dc0d374b547583ed0b85ea4

SHA256
50c5b393dcd308dcea5b65e26ba04c5a5db63c6da22e1983626d100011f4c2f2

SHA512
c81ccca7a72b9202c1186fffc744bb819ea0b11d2a77e81da54fbfc458aa1ab949b1cca97f9ab342235274066ae04e05262e3d4241e3ebfeb612fc2380f298a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\log.txt

Filesize
2KB

MD5
4ea3886b46765d07b63e5c1225b2aab7

SHA1
ff680acf76c22c86f0701b91ee8d25363dd7ff11

SHA256
798a9e6ed40e6ac3c2c14ee81d81ee2986f45714f4d92698110e0e865294fb89

SHA512
9139ac71f8232f8f5faf8ae8f0a78ecf634e8cedd44debc95df8e7c685513fc4174a12222062297d4de6b9bda34a3239bee303d0a905d04c45c65cdc66a8ab56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tll14B9.tmp\log.txt

Filesize
7KB

MD5
77a239fb87ba261480a162e74d17ea4a

SHA1
d6665f357076581a33adcc9b4efd4f743faa320e

SHA256
29b765c55eeb8a8dbbd870df389de37bffed32d9fb54cd0609580d27168dea87

SHA512
6143a94510aec0cdd1af12b98ffada75d37e1fe87081e23d6423a356fc11a348477cc3c9c2942529493f5456f77b7707d3805a65e6d757bdb1ce81eee5cf6e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\ts1A06.tmp

Filesize
128B

MD5
2a0b1e61b6a025358da9b24fe8948f1d

SHA1
f9ccbf12b44160c5a0a02a8195398d31c3391151

SHA256
9c057c42e70f4c19450cceaecffa1ff1246fdff5de02f28aa90c145cdaaa1284

SHA512
48779a4b97c636c88a1ff167c106de403c947948f225d1a4a52b85439a701e33c5672a20d2ce52cff10a9233278b5b708558cc34a28d87144d3cda0869307123

Download Submit
\Users\Admin\AppData\Local\Temp\tll14B9.tmp\Jp2lt.exe

Filesize
733KB

MD5
b05c9d19de9acf53b551882b1f6ace9b

SHA1
a01c58d0fc306ee3fe5ae638d5fc0475478a7e82

SHA256
9565c0dfa6408edc3c8d0e5952446f72e405d71df2a4ba45c0b99c9a6bcb6700

SHA512
54f0cf6886f8bf86520b06efc3a70f702dfd3fb04361f3c39705db7354285ccd8ae637d3aa2b6b5ec875a944ff0c7d24028621453afee9f408e2536e1db77cf8

Download Submit
\Users\Admin\AppData\Local\Temp\tll14B9.tmp\Media.dll

Filesize
173KB

MD5
b29cde18fae164f672e8bfcea5de37c7

SHA1
e1439a0a64d98ed038dc2999c881238c38917404

SHA256
09cf4b6bec3a1891b60156aef51fef4c831b3c37db6cea8381bb1c60128c81fa

SHA512
6548ea2759c565abc2093315899aaf87724daebba1949b778e9ab6507db835b1def5068dee2c20f6da5228989d025349138cef3bf7084f33ad146a1e11f6c187

Download Submit