019ea41357a9f279b02ab96fa77048f4e3892503889fd2ebb0bab89dee405d72

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe
Size

3.3MB
MD5

4063d7fec7b3fc030c554dfd30fd57d2
SHA1

4a3d128868a9cb95ac6d14530059d759a043fb88
SHA256

019ea41357a9f279b02ab96fa77048f4e3892503889fd2ebb0bab89dee405d72
SHA512

b8d98cd4c21a4de0c8a8d95899760b2d8ebfc7530de4ffb826040d4cc42a0d462e96d4fd92a796986433f8d2825cd548688fb3eb5e444a793ecc33791fe61263
SSDEEP

98304:iwh7nMmYp7vOhtwMuSJXBEFi5BUnMHRargrp/:xh7byupVJXyMXZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3032	4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe
3032	4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso4B4.tmp\ioSpecial.ini

Filesize
687B

MD5
56ec1a903c909439314237c1e773111c

SHA1
6fe63c2769daa5830abee62dad7c2a26fed71f22

SHA256
291b4eccec21f6d5e779e53670c2424fa3264663c591fa85f6ca117f67244714

SHA512
305f85d45eb94a6c860b6a8a07dd3da812e2c485e2767df4a8a500ce059b182a5188aad9f6d774dd93c42d37841f73b8392cf4ab873beee37906f0503d57547c

Download Submit
\Users\Admin\AppData\Local\Temp\nso4B4.tmp\InstallOptions.dll

Filesize
14KB

MD5
d970f6e5200a676ded18b2dfb39a3352

SHA1
1d48fb37758c09f3f2a083a2869143383b68daec

SHA256
c2ae27669651fd5d3142e35d3317f46b7b3a9683b49f93ccf575628d55e8a6da

SHA512
86798df839c84e2dae4596f5b210edd18feaf8637ebe7925b7d80015ff321d324da47f129b91fb1c3229cac8d4f45de5758069a3e7cce7c9dd2d19e305131982

Download Submit
\Users\Admin\AppData\Local\Temp\nso4B4.tmp\LangDLL.dll

Filesize
5KB

MD5
0256f5be02329ee0933b1cebc92ff3fe

SHA1
4139ac54f2b9e1f0ab72ec8966159d931107d0b0

SHA256
cb4161c8e340e2843cd7ad32dc6f69115af32cf4ed42272abf5ef338a1473845

SHA512
337ab19f6eb451ba0baaec319d4810e647ead7bdc7f3e0ae5a2dc7e0d5dadfe500bb74ca0f577f1003de8e27418cc35268b7da948878f577f6cbb0ec5b315b1a

Download Submit