1a4a8f183b2481940316133c5daced277ffe01cf7d09ef39a86a6575548e8af7

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe
Size

2.9MB
MD5

3f2565f784cdd02911eacb9380e34dcc
SHA1

d96ddf8eb847840e6c702e45c98dab4193c1d294
SHA256

1a4a8f183b2481940316133c5daced277ffe01cf7d09ef39a86a6575548e8af7
SHA512

43ab6c3f63f4899a1f5f321b94fa9c4ca06f17dd4308cc55d1e7362db7456591e5e5f00fbf4c74b462ac4b78f51dc171f61ee6539a16a09855d02afae7055c4c
SSDEEP

49152:UfI49cqw3sEPk1+Feh+AyGHnq1CFdPJ+52+TRjbWJUTJvjXVg1x:FtPQkeh+ArHnq1CPR+zWJWJ8x

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2372	StpD874_TMP.EXE

Loads dropped DLL 5 IoCs

pid	Process
2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe
2372	StpD874_TMP.EXE
2372	StpD874_TMP.EXE
2372	StpD874_TMP.EXE
2372	StpD874_TMP.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x000d000000012284-1.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	StpD874_TMP.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2372	2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe	31
PID 2652 wrote to memory of 2372	2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe	31
PID 2652 wrote to memory of 2372	2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe	31
PID 2652 wrote to memory of 2372	2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe	31
PID 2652 wrote to memory of 2372	2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe	31
PID 2652 wrote to memory of 2372	2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe	31
PID 2652 wrote to memory of 2372	2652	3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f2565f784cdd02911eacb9380e34dcc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\StpD874_TMP.EXE
  "C:\Users\Admin\AppData\Local\Temp\StpD874_TMP.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstDBFE.tmp\ioSpecial.ini

Filesize
696B

MD5
a3e82515aec33f013e90e111774393d4

SHA1
1427e323dc4b7c988968e5667c9fdd459abafbd8

SHA256
171e4c7648f0ec3aad50729cd0d01f7b315d0ec34af1c59718d3e83b72df0704

SHA512
b5691ca99544e350d1d3d4ce849b984d3b88addbd5feec1fdcef11f9bc4522557af2fd809110ac495cd025f0f5cc6a6622b96d29d90f87244f5c250a09ce9aeb

Download Submit
\Users\Admin\AppData\Local\Temp\StpD874_TMP.EXE

Filesize
2.9MB

MD5
aa06b1d1f1ee931f86f415cf840410e8

SHA1
a51ff776919498ae20e78a1486ba3498a28985e4

SHA256
8f16db1df3f881fa3d6710306a2fbce76d82bb1418739a75a7a586d6ea4f3ae3

SHA512
9b98ac3de31ccbc87b709e174a4e7c035e0639fdd58e9497eb29ecd62a1737086c37b2fb62999a960419efa05ec7f6199f330bb46db019a7a62ffecdd4f1d2ce

Download Submit
\Users\Admin\AppData\Local\Temp\nstDBFE.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit