4a0a7d283e8879ba252b411d45589754c07f43d0910280501e843fdd2f319dfe

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
Size

119KB
MD5

36d7d25c47c6eed50a1ac4d1673119b9
SHA1

12f2e378e612253572e5ae04e25502602ce3db2f
SHA256

4a0a7d283e8879ba252b411d45589754c07f43d0910280501e843fdd2f319dfe
SHA512

d819de715dfdf22c967bcd41fa0559a21a2d2f0ac008669294c77191a514732aba95cbac6829f72d5e69e785884f86e1a2c98c516338654768e74978027cc9bb
SSDEEP

3072:gegjxfR4KBvrTAJkC6OuWehXNqTev3G5Me:9wJz9TQ6OdId7Ome

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
3448	36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36d7d25c47c6eed50a1ac4d1673119b9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsmBD27.tmp\GetVersion.dll

Filesize
10KB

MD5
b1ad64f128719977ea143524d0760280

SHA1
36e44b6a3c940295c59b1b81a8de070fbb4440d6

SHA256
10fd915008c6965b1bf41c59cca5865319175b3756bdfd1741b492c36eadd767

SHA512
06d36675e6599e9975c3916e264c56524b5b25f6e19ef9799bb8ce78dc0d0de6add017f21cb3ebbff6fc5cdaf9903ebfcc4566a201010b516e07cfec0f40deb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmBD27.tmp\System.dll

Filesize
20KB

MD5
fe2a91c85abfb9c1e775088490772c51

SHA1
63a1b422bd0a9fb2b1fe392761f93c25f6fdf578

SHA256
d84d63170249dbae321fe64949bc70b4fca04ec415d524c97b945bfa1e4b49f6

SHA512
b532eff67d1f15e3184303cd358342d8c5595ca75a3e22babaf8af58f923af74f5bb8fc0c3a6da3895b136b2156b625719405b83aee7e68f7b44f5f5ae878286

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmBD27.tmp\inetc.dll

Filesize
24KB

MD5
1efbbf5a54eb145a1a422046fd8dfb2c

SHA1
ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

SHA256
983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

SHA512
7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

Download Submit
memory/3448-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3448-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3448-43-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download