d34bb6bf1ccc0ce74188aeac4527392967f130f03b77d1e8767dee02106fa235

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
Size

3.6MB
MD5

3bf205072839f778ba5681724a17ca7e
SHA1

0d911c1a8310b8733e9ef950b05400bfa1ec5f17
SHA256

d34bb6bf1ccc0ce74188aeac4527392967f130f03b77d1e8767dee02106fa235
SHA512

c0506c5ca70cf0a24c19bc6c8d2934d96e8c9f44b3693938f28126dd7344b76837ae9e77003a6d4a572977ad68de494782b31597ca33d0f15c435623eed8c3fb
SSDEEP

98304:suFw+M2jxvAZ8UyYndpqJ361qnj/awJgZsVe56My:suFw+PtYmYndcpi6ZVA6h

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3788	QvodInit.exe

Loads dropped DLL 2 IoCs

pid	Process
4740	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
4740	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3788	4740	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	86
PID 4740 wrote to memory of 3788	4740	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	86
PID 4740 wrote to memory of 3788	4740	3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bf205072839f778ba5681724a17ca7e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\QvodInit.exe
  "C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\QvodInit.exe" WriteIni
  2⤵
  - Executes dropped EXE
  PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\InstallOptions.dll

Filesize
14KB

MD5
3809b1424d53ccb427c88cabab8b5f94

SHA1
bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e

SHA256
426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088

SHA512
626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\LangDLL.dll

Filesize
5KB

MD5
8c909780802ac2097ea4132e6375acd2

SHA1
b35fbda0725d7c66281d5c340b53eb5d54922583

SHA256
c66b568cd675806a499273e3e8aeda350425aac17fc24342ed54e477417cdc0f

SHA512
e94a37c586e55de8b61b427c14a385dcc57f3602d3dace90ad4663609da14a922cb78f76a58ed211549e987ba6f130cf2581eb48bcad2c9c25c6dc93a7ff6d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\QvodInit.exe

Filesize
109KB

MD5
81a014e8161d8c736603e8a8184c6fcb

SHA1
af03a7bca6826d89c8f0d71c9ea204b294451682

SHA256
decc094e4469459bd86d00eb2bbc1483e071e544aaecfa50008cffd9c3dbb698

SHA512
c7b96bd840fdce3f35fd6f8e978dd143d69d02ffcbf19b9755b7b70f81596b2517a3aadd2d82a6c01f3a13aee43d5cc10f5fbb11e107e6e7790fee7996a90f52

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\ioSpecial.ini

Filesize
718B

MD5
cc5868118d88ef686c228473f00b19b6

SHA1
6a77c298495753573e85cfab71f932983668ce24

SHA256
1f09ee56fe6ebde2a7002cf9c27f8160f08629956d74e9939da159a0c46df841

SHA512
6108107d6d828b3a2efb0796fb96ec1e3d7a9387799106e975e39e54b8c5c688377759665ad69bce42df963cd706c0af74eac39bccd3a1e7a48a84db45c847e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\qvod1.ini

Filesize
982B

MD5
a4432a9177e77c8678fe9ce02f1c159a

SHA1
ac40a3e73edb403cb049a63c4c5d21ca8e57670b

SHA256
03e6d7df3bc99b0be8bd0079ade0c66e5e0ffd93a1bf693caa31b3fcd4cf9a9e

SHA512
5cdce299f233587b34b9e138679223b259bd79f72bdc22c68ef890c3084b295893454c736705ff5f964135707dce99c65ef1602d9b445a31f334ea45b427a314

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssD9B8.tmp\qvod1.ini

Filesize
999B

MD5
9fa094d3b7881e116c926f6819ea1489

SHA1
cb0889c99fd7a47a77d8a8f9db4e73c5871fde0e

SHA256
82ad75136c5e3971e0b1e7c4d8b78b469e8d9996ccb9ec71b984ba85274362f1

SHA512
358897233fa3a1ca8e5d6e801860f4d7b5961e5cb6a6a49acf2bfe4d881b86219c46bc078651d685be188e6704118b08a7fa8436abf22043ebee79100b9a6797

Download Submit