f694c1d55813834d0a08eeb421359220a82929a1c0c614acadc58b4ef1c4b5df

Analysis

max time kernel
51s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe
Size 5.0MB
Sample240622-t5adbavbnf
SHA256 f694c1d55813834d0a08eeb421359220a82929a1c0c614acadc58b4ef1c4b5df
MD5 02f93e9b9381c395975f3fa1d7fad11f
SHA1 8c18720b8fecc1d8a1ebe30010b6ef5fa5420afe
SHA512 bccfbe88b9f8f2b8d8d18d7b466715408af37e870ca812e36fb4d33912d288a6e6e7168e78d0195fcfacff14fae1c4e050050b51e9ee39f24c44c26181eaa47b
SSDEEP 98304:tvE56pI0DwMtgGXrl4x4lDssJHXuLOFSYw1C25/ANStr62r7aCiNpU2D:tLphkgPR1H01YUbkAr62/xiLJD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6120	QvodInit.exe

Loads dropped DLL 2 IoCs

pid	Process
432	02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe
432	02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 6120	432	02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe	81
PID 432 wrote to memory of 6120	432	02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe	81
PID 432 wrote to memory of 6120	432	02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f93e9b9381c395975f3fa1d7fad11f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\QvodInit.exe
  "C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\QvodInit.exe" WriteIni
  2⤵
  - Executes dropped EXE
  PID:6120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\InstallOptions.dll
Size 14KB
SHA256 426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088
MD5 3809b1424d53ccb427c88cabab8b5f94
SHA1 bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e
SHA512 626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee
SSDEEP 192:i6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxT7K72dwF7dBdcQOz:i6JaVh4I5rpPbT7+BdhO
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\LangDLL.dll
Size 5KB
SHA256 c66b568cd675806a499273e3e8aeda350425aac17fc24342ed54e477417cdc0f
MD5 8c909780802ac2097ea4132e6375acd2
SHA1 b35fbda0725d7c66281d5c340b53eb5d54922583
SHA512 e94a37c586e55de8b61b427c14a385dcc57f3602d3dace90ad4663609da14a922cb78f76a58ed211549e987ba6f130cf2581eb48bcad2c9c25c6dc93a7ff6d08
SSDEEP 48:SnTGmVN7ZTPUptxEwvBqAKxwLJXyTpXieN2JVGLalmQ2lUmiwag/nDGkaEJlof6P:+7ZDGEQ9LJX6weN2TuXQ2lBiwag/np/
MD5 SHA1 SHA512 SSDEEP

Submit Download

QvodInit.exe

Path C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\QvodInit.exe
Size 109KB
SHA256 b0eac2d07b4e53935242e06ddca12baf9f02ca09c0dd9fe9bdc72c77d824eac6
MD5 0c2bf8f2a44bc460e87d5cf3baa63d58
SHA1 93e25c9a19c060df831dfbbaa7eb9acfa102b535
SHA512 f191c1bca69739ed1c88311dbe0af05685177744632b458d2ae0425d1a171c7259e7f4e1d9c2aa2999489a3a525be85101b80d2b2269677a3b82b9c1b60a98c5
SSDEEP 1536:SMBfKFgpr2N6FcGpmN/xjETJJl+Vz0ijKSHTNf2Xh9PRUGVASsu2VNaLCKG:pR4nNJ4TJJl+50iuSzNOrRUm2V4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\ioSpecial.ini
Size 734B
SHA256 b19c3a582d9641cbb278e08058de95b0a3210985e095f349abfe284d441a1580
MD5 29189b3558273ae04ea8aa983afd9d6e
SHA1 2366677b6b9a32d1be683fa7b9b96b46b64cf7fc
SHA512 7c36c48c7b493d1f3c9ac03e6ff59bf159bc78879ab7b9ebcaf0dbd98835d1b9d18785fe5d5d122ea32a12ae4bacc31c34e03c20081c7533b024b8a10fbcfe0a
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\ioSpecial.ini
Size 773B
SHA256 847b4af184cc8439700b7ce3b75b3e43c0593604d9f9d95f1848f128a9eb19c7
MD5 dd6e53ff6296a71b63f4f5bf64b9d2f8
SHA1 21db44f7cc0f7d96ee9a3784b3132fc51634bebb
SHA512 5d58ec1c3bec9dc9f17203f612c30aec4c3a536a4462eded87ba08f4496706ce2f980dce23749b2469a2fc6ae76ff6bcb1d3218b6c320e7a8d013b19cd302be2
MD5 SHA1 SHA512

Submit Download

qvod1.ini

Path C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\qvod1.ini
Size 999B
SHA256 d8c42cb9d9e3055f401f8f2ba21f1a0bc648abbbb614bb0c9d154a2e052b825a
MD5 f310a3c7d1acc72ad81c6989e738dfb8
SHA1 40c3659666b4d65a32753cb666826923712a9161
SHA512 ddea91394e93f307f0ac25e43dd595dfc6298c3589f2472eea36abd902ef6bf12d55a4e0f8c492a9070ce3fb1c3b431af54386b57ae2367b49dfb7c34b4917f4
MD5 SHA1 SHA512

Submit Download

qvod1.ini

Path C:\Users\Admin\AppData\Local\Temp\nsy43A2.tmp\qvod1.ini
Size 999B
SHA256 82ad75136c5e3971e0b1e7c4d8b78b469e8d9996ccb9ec71b984ba85274362f1
MD5 9fa094d3b7881e116c926f6819ea1489
SHA1 cb0889c99fd7a47a77d8a8f9db4e73c5871fde0e
SHA512 358897233fa3a1ca8e5d6e801860f4d7b5961e5cb6a6a49acf2bfe4d881b86219c46bc078651d685be188e6704118b08a7fa8436abf22043ebee79100b9a6797
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads