0078eb05ca7f4851acdfeb0fca6d238e38f3f2c492c43ce4040b2b0d6a9bba7f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0de85d4f5605c7a6ab6b00486c508c4f_JaffaCakes118.exe
Size

378KB
MD5

0de85d4f5605c7a6ab6b00486c508c4f
SHA1

1a58ab66899867db6249faa0e55e656c0315f800
SHA256

0078eb05ca7f4851acdfeb0fca6d238e38f3f2c492c43ce4040b2b0d6a9bba7f
SHA512

253dda5a2d6390a21a1233e75746e5e5a2dd49f6c3533bfed3056b8be1b8c2bade5f44bcc6083f3dc7ff6839e72366dfcc8275d5c79866e2c9b94513b59dabf2
SSDEEP

6144:Y+npvsRnbQrEE0psrdH+apo31QtlRP/p3xgG7NQm+kATGJcthBGY:PckrVNrdPtnP7RQm+rbthAY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1160	0de85d4f5605c7a6ab6b00486c508c4f_JaffaCakes118.exe
1160	0de85d4f5605c7a6ab6b00486c508c4f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0de85d4f5605c7a6ab6b00486c508c4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0de85d4f5605c7a6ab6b00486c508c4f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso1538.tmp\NSISdl.dll

Filesize
14KB

MD5
f0419089787f4bd9d422c9d1933e0932

SHA1
000235068a70817d5e2897b684188433cb9c4c9b

SHA256
1ac04e7a5efe274d9cdfe51162719d93d765c5cd565a2bcfadec3e9618baa086

SHA512
ebd3f38fe268687269bdb3d6a814dfff8659d3655cea692fc914be42a78d8b82f3d2d7af9267359d97c4d6af68ae03d8e6e5374c774a02f356b103b1a6e09ad3

Download Submit
\Users\Admin\AppData\Local\Temp\nso1538.tmp\System.dll

Filesize
11KB

MD5
f55b41485cbaf292389a52f8e4f0594b

SHA1
89e9b0d1291fa78a40cab358553c447cbbeaa130

SHA256
f16bc2ceb7a6bc7df0955530e72b0aa072ce27650c5cf7b33fd4ea82dea196fc

SHA512
938e8661b8cf418608156dc813c1eb0cc3fa5efa9483061a152bb103c4d821d5c6a82d4c110729e9686f99ccd4da188aebb38a85a01d8ecadb34bb9f6ba60d09

Download Submit