90860e498b9d4204744e64736793a3c92c1a1cabb218f8140b8ee851206399e2

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 10:30

Target

22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe
Size

62KB
MD5

22080ad91cf1a69c1ab07473e56f84fa
SHA1

e52783cc926e30e85a566844115b21cccc5c4aa8
SHA256

90860e498b9d4204744e64736793a3c92c1a1cabb218f8140b8ee851206399e2
SHA512

cba9f676a5360db15fa94a293cdc70843187e7a5c6d04ac372c2a21cc34c5f30dde4e64b1935e16a208b67b36467e1c938022c4d160439b2f91168540642667a
SSDEEP

1536:sppal05FyuC/jL052PgFEla4ZJJcCw+zR5NiOAkas9Vz:sp8l05FyX0mpa4ZJJcP+z15aOVz

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2260	Au_.exe

Loads dropped DLL 5 IoCs

pid	Process
2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe
2260	Au_.exe
2260	Au_.exe
2260	Au_.exe
2260	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000013a2e-2.dat	nsis_installer_1
behavioral1/files/0x0009000000013a2e-2.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2260	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2260	2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2260	2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2260	2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2260	2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2260	2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2260	2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe	28
PID 2756 wrote to memory of 2260	2756	22080ad91cf1a69c1ab07473e56f84fa_JaffaCakes118.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst1383.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
62KB

MD5
22080ad91cf1a69c1ab07473e56f84fa

SHA1
e52783cc926e30e85a566844115b21cccc5c4aa8

SHA256
90860e498b9d4204744e64736793a3c92c1a1cabb218f8140b8ee851206399e2

SHA512
cba9f676a5360db15fa94a293cdc70843187e7a5c6d04ac372c2a21cc34c5f30dde4e64b1935e16a208b67b36467e1c938022c4d160439b2f91168540642667a

Download Submit
memory/2260-16-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download