583b51287187df514ef222f1aee18d48424a64a9f50909dd27a47ad245f863c2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24c50d287358d8bbbb2bf80e361baf63_JaffaCakes118.exe
Size

1.0MB
MD5

24c50d287358d8bbbb2bf80e361baf63
SHA1

eb0afff5f966f6759324c16e288e4a1398fd1b36
SHA256

583b51287187df514ef222f1aee18d48424a64a9f50909dd27a47ad245f863c2
SHA512

af85db8f65f229e2a790d0e06d4890e9a5b0aa1ddc8f6a0dfc8dfe3175badb1b7b2d35d20a283c5e32340178651a0cb7358d7804b561b83365406439f214622b
SSDEEP

24576:kf+VLLoy7yDZgDstOXV7cFxAtdEBnBEwOvMOW57Phq1uvO1zSqqhi3v:UyH7yFgiOt2BnXll7P+KOUe

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1920	24c50d287358d8bbbb2bf80e361baf63_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	24c50d287358d8bbbb2bf80e361baf63_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\24c50d287358d8bbbb2bf80e361baf63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\24c50d287358d8bbbb2bf80e361baf63_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoF6D.tmp\ioSpecial.ini

Filesize
646B

MD5
67108236374a9e2a06aed8a798e010f8

SHA1
2f7c2b13fcda638b1b0a359de67fdd67ea9771f4

SHA256
357d1ad12cd09d81397f66c51593ff89b13b8e20df9278a6597784f92d3ce3f0

SHA512
b5f3b85da1813d956ba3d3f5235b8c08cf528aa929f016496e6a3e4cc18cd4dac31f3c08aec0aa9cab15611e53511ca18dfa30f133505ea1c1c43d75f5f517c5

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF6D.tmp\InstallOptions.dll

Filesize
14KB

MD5
0dc0cc7a6d9db685bf05a7e5f3ea4781

SHA1
5d8b6268eeec9d8d904bc9d988a4b588b392213f

SHA256
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

SHA512
814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

Download Submit