d34bb6bf1ccc0ce74188aeac4527392967f130f03b77d1e8767dee02106fa235

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
Size

3.6MB
MD5

3bf205072839f778ba5681724a17ca7e
SHA1

0d911c1a8310b8733e9ef950b05400bfa1ec5f17
SHA256

d34bb6bf1ccc0ce74188aeac4527392967f130f03b77d1e8767dee02106fa235
SHA512

c0506c5ca70cf0a24c19bc6c8d2934d96e8c9f44b3693938f28126dd7344b76837ae9e77003a6d4a572977ad68de494782b31597ca33d0f15c435623eed8c3fb
SSDEEP

98304:suFw+M2jxvAZ8UyYndpqJ361qnj/awJgZsVe56My:suFw+PtYmYndcpi6ZVA6h

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	QvodInit.exe

Loads dropped DLL 7 IoCs

pid	Process
2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
2940	QvodInit.exe
2940	QvodInit.exe
2940	QvodInit.exe
2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2940	2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2940	2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2940	2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2940	2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2940	2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2940	2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2940	2488	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\nst9B67.tmp\QvodInit.exe
  "C:\Users\Admin\AppData\Local\Temp\nst9B67.tmp\QvodInit.exe" WriteIni
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst9B67.tmp\QvodInit.exe

Filesize
109KB

MD5
81a014e8161d8c736603e8a8184c6fcb

SHA1
af03a7bca6826d89c8f0d71c9ea204b294451682

SHA256
decc094e4469459bd86d00eb2bbc1483e071e544aaecfa50008cffd9c3dbb698

SHA512
c7b96bd840fdce3f35fd6f8e978dd143d69d02ffcbf19b9755b7b70f81596b2517a3aadd2d82a6c01f3a13aee43d5cc10f5fbb11e107e6e7790fee7996a90f52

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst9B67.tmp\ioSpecial.ini

Filesize
718B

MD5
c873900d2b3e68d17eb461139ad44e90

SHA1
f9ab6141bfe0974b570d8e3f7abe3ae3690924b8

SHA256
63cd045d60b893ca01aa70fb30bd20a129ab3c5cad5f8bb7026bbb94caa32f20

SHA512
43e2740768043f0f9c793a9e8624a5f2706ca1c2167145a19dfd18e8a0fa685152dbc582d7e590ab3b1d329cd258b0d9a4be754e25b9b8bee3396dea61c99c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst9B67.tmp\ioSpecial.ini

Filesize
757B

MD5
f468bab82ace1547297155ce80e3c70d

SHA1
fa10544b2c00a69b27c1e7dda120a5631c6b3eb9

SHA256
ddcda82aaa9cabe1516cf21dc19a990bcb39b777361c1bfd05c17a313dd72f02

SHA512
aba62a923c654b202927c29ec3a3c27dead79d91509de4586b555d766838088f0c07cacb67c5f9111b90567321df2badc381509ccb1886a317eec07d63083df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst9B67.tmp\qvod1.ini

Filesize
999B

MD5
9fa094d3b7881e116c926f6819ea1489

SHA1
cb0889c99fd7a47a77d8a8f9db4e73c5871fde0e

SHA256
82ad75136c5e3971e0b1e7c4d8b78b469e8d9996ccb9ec71b984ba85274362f1

SHA512
358897233fa3a1ca8e5d6e801860f4d7b5961e5cb6a6a49acf2bfe4d881b86219c46bc078651d685be188e6704118b08a7fa8436abf22043ebee79100b9a6797

Download Submit
\Users\Admin\AppData\Local\Temp\nst9B67.tmp\InstallOptions.dll

Filesize
14KB

MD5
3809b1424d53ccb427c88cabab8b5f94

SHA1
bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e

SHA256
426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088

SHA512
626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee

Download Submit
\Users\Admin\AppData\Local\Temp\nst9B67.tmp\LangDLL.dll

Filesize
5KB

MD5
8c909780802ac2097ea4132e6375acd2

SHA1
b35fbda0725d7c66281d5c340b53eb5d54922583

SHA256
c66b568cd675806a499273e3e8aeda350425aac17fc24342ed54e477417cdc0f

SHA512
e94a37c586e55de8b61b427c14a385dcc57f3602d3dace90ad4663609da14a922cb78f76a58ed211549e987ba6f130cf2581eb48bcad2c9c25c6dc93a7ff6d08

Download Submit