Overview

overview

7

Static

static

3

478588aa8a...18.exe

windows7-x64

7

478588aa8a...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 00:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    478588aa8ac41d4d00fa1574ca89c78d_JaffaCakes118.exe

  • Size

    393KB

  • MD5

    478588aa8ac41d4d00fa1574ca89c78d

  • SHA1

    0d5288553740187248c5b76fd2925d1575e5fd7a

  • SHA256

    25ae8ce73d15e85a13105e870a3314d21a0b062c68e853566e8a4afe919f20e7

  • SHA512

    2939a9006ca44072938387c58612f2cdc1a22b849363e5445ffc773a1c11e59ad2305a28f3de05c39e7ce6b29f45c7a327e7f7ed20cb3bff347275df872ad223

  • SSDEEP

    6144:RQqJRYshwsTTt5+gmYWRcYzCC8C5giReOW3w+ihcj0BACAQmwDI4xppnzXvRH:pRYspTt5SFSnC7rAOWA+ihcj0to4d7vZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\478588aa8ac41d4d00fa1574ca89c78d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\478588aa8ac41d4d00fa1574ca89c78d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:556

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsaA161.tmp\System.dll
          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsaA161.tmp\nsProcessEx.dll
          Filesize

          40KB

          MD5

          8937e220137964560e112dc0ae61434d

          SHA1

          ad02b77cd0c65d6baa4d847d742f4329c58344c2

          SHA256

          21febef784eb72f9d867c8c867f127e3a3828ff867bf5514462f25d914576109

          SHA512

          2a0eaec20cb9f9c30a6e99994c57f1cabba042ee2b936ae0234dfdbd505ddc1b8f091e89d7b8cbf2cc4bbf59bbf53be7cf15aa6e85901a5ec64f461829cbedb0

          Download Submit