d59f4ff652e70144e796a902eebe172cf1c85da030ca07e939b41ebb2254c897

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
Size

119KB
MD5

290c4bd501ec3e038fdf4014f1213e6a
SHA1

1ccaa4bb821b427271896bbba1adf40b3242cdcc
SHA256

d59f4ff652e70144e796a902eebe172cf1c85da030ca07e939b41ebb2254c897
SHA512

2e55e495c0f6a9636e5a32b454f2f2c44a04058670fb24307e30361999452c0e1a37a525154b125806f584c286e0664f47a508fe225b5b9610090c70f403f2af
SSDEEP

3072:gegjxfR4KBvrTAJkC6OuWehXNqTsv3G5M6:9wJz9TQ6OdIdDOm6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 31 IoCs

pid	Process
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
1916	290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\290c4bd501ec3e038fdf4014f1213e6a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu45A5.tmp\GetVersion.dll

Filesize
10KB

MD5
b1ad64f128719977ea143524d0760280

SHA1
36e44b6a3c940295c59b1b81a8de070fbb4440d6

SHA256
10fd915008c6965b1bf41c59cca5865319175b3756bdfd1741b492c36eadd767

SHA512
06d36675e6599e9975c3916e264c56524b5b25f6e19ef9799bb8ce78dc0d0de6add017f21cb3ebbff6fc5cdaf9903ebfcc4566a201010b516e07cfec0f40deb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu45A5.tmp\System.dll

Filesize
20KB

MD5
fe2a91c85abfb9c1e775088490772c51

SHA1
63a1b422bd0a9fb2b1fe392761f93c25f6fdf578

SHA256
d84d63170249dbae321fe64949bc70b4fca04ec415d524c97b945bfa1e4b49f6

SHA512
b532eff67d1f15e3184303cd358342d8c5595ca75a3e22babaf8af58f923af74f5bb8fc0c3a6da3895b136b2156b625719405b83aee7e68f7b44f5f5ae878286

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu45A5.tmp\inetc.dll

Filesize
24KB

MD5
1efbbf5a54eb145a1a422046fd8dfb2c

SHA1
ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

SHA256
983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

SHA512
7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

Download Submit
memory/1916-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1916-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1916-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download