9215ab1381322926dab7a9a78b2228a8830904bd9e54b7e9afe0644eaea451fe

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe
Size

2.2MB
MD5

0c19a57ba5a27f44e49088e38970422a
SHA1

73ef51fa1eda3856f49f89abe277296f19623ee8
SHA256

9215ab1381322926dab7a9a78b2228a8830904bd9e54b7e9afe0644eaea451fe
SHA512

ae1df39575f6dea82ded7d22b0cebc0b050d816f7ea5836d25535c7184ad3e6aa00112e18fc4955d89cdebda18865e83f388f9575189df4435696f082d1e2d0c
SSDEEP

49152:RZHz1L2qckgRAP65vdEfPQjDAOrYmYR356G8yUTT37cMOT:jT1L9c7KACQjDAyYmYj8n376

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2188	0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe
2188	0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2188	0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe
2188	0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c19a57ba5a27f44e49088e38970422a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd198B.tmp\showone.html

Filesize
621B

MD5
e774b6e446982f70e493c49e68a9a6bc

SHA1
655a1631b66f3147e59b686c54d6bdb0c8667bf6

SHA256
1cd81e8c1ac0192efbfd0bb31e2c04ba810a87694d36666cd1215b73c7fe5dda

SHA512
c53901dfa992d107351de2b892af64a3c829ffec924025f1ff3ee14740f2aac45db687c1a78a97c8e71ea94d8cbc12bd7da7cde3a656e7e48a869e5e03f02209

Download Submit
\Users\Admin\AppData\Local\Temp\nsd198B.tmp\ToolTips.dll

Filesize
4KB

MD5
9a0da2692764bb842411a8b9687ebbb7

SHA1
5c3a459faa08a704bdf162476897ad4580ae39bd

SHA256
28aeaa48c929188a0d169887cc3f16370741467ae49e1db59763f030710a6bbb

SHA512
814d686617df4fe9f50a93dac9428babff3a14836aa27b4666976379ec3fafcab65fd82d8886998fa65e7b59dc192ca067cf8b4cdeb8ef551812912d80dab8ed

Download Submit
\Users\Admin\AppData\Local\Temp\nsd198B.tmp\WebCtrl.dll

Filesize
5KB

MD5
418a34a689d5f9bb85fc951168749edb

SHA1
0b75ce26883e12944abdbb67c143000fd0905d6b

SHA256
915322078d1f8eb278250f446c1960e1555ffa0f8dcd048a48ed32fe7f5a5b3f

SHA512
9aabb74cfd37cbda4718077ba76c7906e0f3ab5949e99f9d800fb1952757a60cabe29413f054f62e2887ff57aeb9d355532fd1662ebf3a523a500b20fe702b90

Download Submit