5976e037d6566d69a00c443532b6463373f94f6fe33e4e96ead1e4656c824290

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe
Size

698KB
MD5

2d94069398144fddc58ae08242b94d0a
SHA1

2c9ecbeeec2e3fbc8ba260a38efc60209bbcf011
SHA256

5976e037d6566d69a00c443532b6463373f94f6fe33e4e96ead1e4656c824290
SHA512

df188d529b9080446ffe670d3f41472aa20a6aa47a5c3b6e403a503e31feaedfd3447a9d3e3267977c81e5e8dec23ed010fb0046ede0c9f08d06e999dcf50e8a
SSDEEP

12288:p4+RNfJ0b9tW8SUedSrA2HGlTdb5ZTzAx3TvTC4EBB66ybl2LF7KSUqFIGJfgqFz:p4+neWdYrvHIfTIT/Cml24SUgIGJfgqB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2092	2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe
2092	2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nseE11E.tmp\ioSpecial.ini

Filesize
750B

MD5
6b4b1d34d582e9524ef910ced112c9f0

SHA1
71a37fd01a8f1f43cf19216917c18dee9d59d6e1

SHA256
d07792dd43584a698f418633c68536ec9c476aaa59f931a871b2276aca8b7a8d

SHA512
369ca138ba6b3ac76e4a3cafcc79797743ba8c2701a957aa93c37c0cf78df2fc56601d0a15e948eb53d8aee19f38b06bc4f28dbcf705b8affc33c0f4be5f9139

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseE11E.tmp\ioSpecial.ini

Filesize
763B

MD5
407748ba0d2ce2999d4df839fa62e441

SHA1
cd68a563c784ec60ead2ca9e72cb70b63f2beae5

SHA256
784d9e73b7e4b9236a0abaaf1f255d3a684c4b01085a13c48c42230400ca1e08

SHA512
53d6afcfd5a7093cb83ac087544474bfc9449f21320e24bef81152246628df7cc0c6635968a974a0550364554a50175f1a2188120ef3be97823ad687b0a92eb6

Download Submit
\Users\Admin\AppData\Local\Temp\nseE11E.tmp\InstallOptions.dll

Filesize
13KB

MD5
d765c492c21689e3d9d61634371fd861

SHA1
ac200933671ae52c9d5544d0e2e8e9144d286c83

SHA256
551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

SHA512
9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

Download Submit
\Users\Admin\AppData\Local\Temp\nseE11E.tmp\System.dll

Filesize
10KB

MD5
fe24766ba314f620d57d0cf7339103c0

SHA1
8641545f03f03ff07485d6ec4d7b41cbb898c269

SHA256
802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

SHA512
60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

Download Submit