43dd818938f2a189ae43dcaffa558ad39d518aa60ac096f0cdc0f1c35677a249

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ae6aa15892207c7e6323c9101c9a900_JaffaCakes118.exe
Size

8.9MB
MD5

4ae6aa15892207c7e6323c9101c9a900
SHA1

513419ca2ba6531930e117d31833d39702121c27
SHA256

43dd818938f2a189ae43dcaffa558ad39d518aa60ac096f0cdc0f1c35677a249
SHA512

fbe7b4c1ae48d22f3b8a942127276a4cd1013d56880d8cea0acf6c584e5bb49054e9c948774d6debd29e8e03eedd753e84a0cb994534330a0aa03da38cc37ab4
SSDEEP

196608:dOxdnAHBH4QeK+UKoWSJplr0G9qj4YVemKLttARTzXcJ:d8V3QgloWSjlrZkcYVzKzsTzsJ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1928	4ae6aa15892207c7e6323c9101c9a900_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1928	4ae6aa15892207c7e6323c9101c9a900_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4ae6aa15892207c7e6323c9101c9a900_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ae6aa15892207c7e6323c9101c9a900_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoB83A.tmp\ioSpecial.ini

Filesize
726B

MD5
9fb3e5255253bb2541c95b6d65e44399

SHA1
1b615a47a0858b4ce3ea06832c6034a8bb765c13

SHA256
8965a60043d951621d29f0e86f95abb9cd51044656a802a373b404327c3ce696

SHA512
68968253e7551d896c79b1544e846d1d72812801da8781ad676d335f18c51d9a9576d54b40239ae44d9b7eff1a2e523192f6a47299940a55b06bdaa2b432bc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoB83A.tmp\ioSpecial.ini

Filesize
765B

MD5
5466186e4204b907848bd0c5b1c7f7fb

SHA1
240c4c74cec471125f3c23f082faf352f99610de

SHA256
e8fb3b38915d3f26ce2b7465907994b8316835aed241adc5202b01e3b1bf09d8

SHA512
9ec96579741df259e8fddf52f5a9823d1cab7256916af915292ffee4e41784a7fd71ecbbf45786ac82610a9c3ef7908e534937edd2bd923013983e3412530d8f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB83A.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit