1d379753a098d960d3c5910a1af041cd55ae15ded3b1906d44be8b567c7873b5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

195172c84c7233a1a6e53b491635694e_JaffaCakes118.exe
Size

102KB
MD5

195172c84c7233a1a6e53b491635694e
SHA1

6b4a21244e27e02c3ef7f65820a49a9b2e335edc
SHA256

1d379753a098d960d3c5910a1af041cd55ae15ded3b1906d44be8b567c7873b5
SHA512

8b938bfd90cc50c0b0c61ba8ad1c7c5d4d3f91691b1f6b23b83862aa13df4c632b3a043a755113a6908376773a6af7c008858b41170191b77b24b642b4b02235
SSDEEP

3072:y80IwJxDieMR2F6hDmxLeWmzHp7WNcGCKd0y27Wbk:yVYR28hmdeW+p7qX3bk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1988	195172c84c7233a1a6e53b491635694e_JaffaCakes118.exe
1988	195172c84c7233a1a6e53b491635694e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1988	195172c84c7233a1a6e53b491635694e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\195172c84c7233a1a6e53b491635694e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\195172c84c7233a1a6e53b491635694e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gentee00\gentee.dll

Filesize
96KB

MD5
427d8406efd63d3ed906c565c73fd610

SHA1
58b4d079e9e672cdf3bd234a15ee23d0f6393b86

SHA256
916a58e9bd8327792e4fdb83d4439536ce88ddc3a6cdc69cae579af7088078dd

SHA512
9ba70be20367295c9187e8419d7e0e6444f821292d4e021611c1f13ff91e78f86fce285f50d793a34c34569fee225362e5232737797836d89e15aabd17f03cf3

Download Submit
\Users\Admin\AppData\Local\Temp\gentee00\guig.dll

Filesize
20KB

MD5
fa3db33dcefded7b4fdcb948a5e6e53e

SHA1
0adfd644e4422ffcbcfd8bfc27fcec727f04836e

SHA256
424025e13c1a624d5900f7b264145907e1092ef68e9c51d76a2648d14fdb9a17

SHA512
9be40412d7a8939a41c764058b138f1aa6fa73e0f1d2aa8c251c4e58c0cedbcf9aeee1bf669fc4347e1bccc7a9310f25ebe4731530cc5d99c64e31ef6073623a

Download Submit