c1fd681d84c426ef1a35e8e64a16996371aca27314d82bc609966a7e47736ea4

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 21:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe
Size

1.1MB
MD5

31f7574b0b09b8c524769496983970c0
SHA1

ab509cb8df534f9d365e4ede38f92c9b0f9f0de7
SHA256

c1fd681d84c426ef1a35e8e64a16996371aca27314d82bc609966a7e47736ea4
SHA512

1698aeba8ca076c181fcd40f37897139b43aa48a0001d5e46a4919d058d3e5ddc5386ac26778d51f61ec8903195c0f9815084ea49157519f56f30443632c8dad
SSDEEP

24576:2e9n6Qtiq50vPxkgTnELFpPk2lf+c9k7mHhTwRw8jJiPGT:BnrzSnxkyEppP/W/mBMRZjJiPGT

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000012274-1.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
1564	31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe
1564	31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe
1564	31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1564	31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31f7574b0b09b8c524769496983970c0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdBC8E.tmp\ioSpecial.ini

Filesize
615B

MD5
a86fed8e9e0f92ae2b47d0015c7c69bf

SHA1
0b1e901f9c4922b38071cc2a1228d90bcb4c3d05

SHA256
3e246da1c3672e5a9bdf3912a73b39d69009ed5e183922c942fc2da569f07133

SHA512
064ac336b35c42ef283c57482c533c9b2b3a8dc5d22d9392dce3b45e3e58c5621084b95bbf35a8cd9abe14ad14c1cfeb2e7087c0390d713be8940125020101eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdBC8E.tmp\ioSpecial.ini

Filesize
654B

MD5
0d14829379553ec3f9fd1bb2cffa15a7

SHA1
9acc68f2c706f0bc55eb6abfbbb7e3f89246cf8f

SHA256
530b42058a3a0a44c939e91cd9f1a0c44d4911103ed1398a74afc24e55efeae5

SHA512
9a502948f32d84ed5568c7af06b4aa49124d70c5f30cb2d96474f18ecc100064de09ccc19ee3c352b6068e0abfcbd65d63f882b469fe2b467fcd77df04bcd4b8

Download Submit
\Users\Admin\AppData\Local\Temp\nsdBC8E.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
\Users\Admin\AppData\Local\Temp\nsdBC8E.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\uslBBD0.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1564-4-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download
memory/1564-3-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1564-93-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download
memory/1564-95-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1564-100-0x0000000000260000-0x00000000002D3000-memory.dmp

Filesize
460KB

Download