d58e89fb349366c78287a046823e7392261ca8d6d9b0e93c9a867308986b4398

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe
Size

913KB
MD5

0880ed80993360d6f47d0b8dd33af109
SHA1

3b0c7b6acee651379b9320504d44fca15453d16c
SHA256

d58e89fb349366c78287a046823e7392261ca8d6d9b0e93c9a867308986b4398
SHA512

2c6f2b1920e5e31b1d2dfe31a4a8d4f1d985f2e0986cd1e0024a825786b3f72af3d96771030838f8989d4fffce52bf7f67f9d9a88089c72d3f40e6ef84c52744
SSDEEP

24576:B+7aI6NBhg3aRaYeA2v3PBF2r7/fL+civ6/:BXIK2aRBeA2XBwDLsv6/

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2220	0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe
2220	0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe
2220	0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso192E.tmp\LangDLL.dll

Filesize
5KB

MD5
1775e8fe7832f0351d4024ba3478c58d

SHA1
3a2aafd8275f384332f6d08224d927040ce37cb4

SHA256
a2a159540c738c7bc4d6ce8dd203bf859078409c0021a2a60f4b0faa5352d375

SHA512
362cda0e1f50a8fecde1611863b1c6218962e3ec198ce3641ce50910d400ac647cdc3742888140fd6817ce6b30d83865aa0c72292bb80b1ae86cab419e0fb2b7

Download Submit
\Users\Admin\AppData\Local\Temp\nso192E.tmp\System.dll

Filesize
11KB

MD5
c6f5b9596db45ce43f14b64e0fbcf552

SHA1
665a2207a643726602dc3e845e39435868dddabc

SHA256
4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0

SHA512
8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a

Download Submit
\Users\Admin\AppData\Local\Temp\nso192E.tmp\nsDialogs.dll

Filesize
9KB

MD5
f2c993a0c726386d72e4640967cef83e

SHA1
efe88db252b5e9edff2d859e783fcf1a349e553f

SHA256
6739a2c8075cc383620a867e983957de0b4ae9ef0453baadd1469132893d7301

SHA512
3873a87ba360702c72a6d3e853a0b6f2df219593cf5436d12a9d4d169029e939993c45330212008b628184da64ae98d6a7ab42b30d5f82c896acfc89d558169f

Download Submit