32b4bc7fefad278dca61055c972b0f2e0e2a7f3a25e087b85e38c895f1e7fd5c

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1549c1e71c2829f9797d9cf5f24e106a_JaffaCakes118.exe
Size

14.3MB
MD5

1549c1e71c2829f9797d9cf5f24e106a
SHA1

8422793a9e97355af4903d149bf944a8b3f02364
SHA256

32b4bc7fefad278dca61055c972b0f2e0e2a7f3a25e087b85e38c895f1e7fd5c
SHA512

007b78079c87788829920228355bf9ad42531141886a128f7595e7067a77bdedd5c1d2ff85f02c95a6bc8bc092cffb3548476e0bbf0ec6b8ca0d0e1707699b02
SSDEEP

393216:SEAYhqaenepkzAEb1SVn3CcDyrt8vWL8Qr:SEXqL2ktpS4myrsWTr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2968	1549c1e71c2829f9797d9cf5f24e106a_JaffaCakes118.exe
2968	1549c1e71c2829f9797d9cf5f24e106a_JaffaCakes118.exe
2968	1549c1e71c2829f9797d9cf5f24e106a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1549c1e71c2829f9797d9cf5f24e106a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1549c1e71c2829f9797d9cf5f24e106a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc3450.tmp\InstallOptions.dll

Filesize
15KB

MD5
67d8f4d5acdb722e9cb7a99570b3ded1

SHA1
f4a729ba77332325ea4dbdeea98b579f501fd26f

SHA256
fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7

SHA512
03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc3450.tmp\System.dll

Filesize
11KB

MD5
959ea64598b9a3e494c00e8fa793be7e

SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0

SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc3450.tmp\ioSpecial.ini

Filesize
988B

MD5
e6d284dfb80ba495c6354e2da2b2943b

SHA1
009c59462f9d286386a8da483723f396085da1db

SHA256
9e84db39fa0b126397ee343fd1bf5ad83237d217dd745a776f53dfa97e5fec1b

SHA512
de2e51be25eb29080c08cd4102184a1dd42199c203e1585c0e41ad69f0c714a14149794deebdf75262ab57044665416fea617d9d405f4774b5f584feb153787c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc3450.tmp\ioSpecial.ini

Filesize
1KB

MD5
da7c0d03b702c6f652d450934d0fbbf9

SHA1
7f0baa27f91618ed1e573b018c06d978bf5de01c

SHA256
83e6988b096dc2d57b58a294cda89677fb5d1bb00417a525bcf4331ad552f921

SHA512
16c8d4956cb8e1c6e2c5abfd3ca9a13aa52dc0f90b8694ac73582ceb783eb0707239002bfc6fa6123f204696732a158cd27c8c671f286926dafc0663b8173582

Download Submit