019ea41357a9f279b02ab96fa77048f4e3892503889fd2ebb0bab89dee405d72

Analysis

max time kernel
96s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 05:34

Target

4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe
Size

3.3MB
MD5

4063d7fec7b3fc030c554dfd30fd57d2
SHA1

4a3d128868a9cb95ac6d14530059d759a043fb88
SHA256

019ea41357a9f279b02ab96fa77048f4e3892503889fd2ebb0bab89dee405d72
SHA512

b8d98cd4c21a4de0c8a8d95899760b2d8ebfc7530de4ffb826040d4cc42a0d462e96d4fd92a796986433f8d2825cd548688fb3eb5e444a793ecc33791fe61263
SSDEEP

98304:iwh7nMmYp7vOhtwMuSJXBEFi5BUnMHRargrp/:xh7byupVJXyMXZ

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
3836	4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe
3836	4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4063d7fec7b3fc030c554dfd30fd57d2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:3836

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsj9E45.tmp\InstallOptions.dll

Filesize
14KB

MD5
d970f6e5200a676ded18b2dfb39a3352

SHA1
1d48fb37758c09f3f2a083a2869143383b68daec

SHA256
c2ae27669651fd5d3142e35d3317f46b7b3a9683b49f93ccf575628d55e8a6da

SHA512
86798df839c84e2dae4596f5b210edd18feaf8637ebe7925b7d80015ff321d324da47f129b91fb1c3229cac8d4f45de5758069a3e7cce7c9dd2d19e305131982

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj9E45.tmp\LangDLL.dll

Filesize
5KB

MD5
0256f5be02329ee0933b1cebc92ff3fe

SHA1
4139ac54f2b9e1f0ab72ec8966159d931107d0b0

SHA256
cb4161c8e340e2843cd7ad32dc6f69115af32cf4ed42272abf5ef338a1473845

SHA512
337ab19f6eb451ba0baaec319d4810e647ead7bdc7f3e0ae5a2dc7e0d5dadfe500bb74ca0f577f1003de8e27418cc35268b7da948878f577f6cbb0ec5b315b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj9E45.tmp\ioSpecial.ini

Filesize
688B

MD5
7aeb814d2edca8f967ef412d13200649

SHA1
89693efe02187df89cb0799c9ef6d99a2b088dd1

SHA256
ff2e20025ffa4fac7376abecb244908a4b8db7fdc036196901d5b07c98fcb704

SHA512
2780fe3a669274345a3019f0319c904f9403e22173af89b4c8aa974ab84a8afeec3c2a2b6d3c68954978a0bfe33d8e3acc7c214aa7791a88a11f483d36ea7253

Download Submit