51112c067bd5c87a44698ec80bf9873160eee16b2d7c9775786e41724a06ecd7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118.exe
Size

17.6MB
MD5

4b0e190b8bc86042666a041fe7ce5fa0
SHA1

6f81a0b91529659982a4ac5a6d507b53f671b438
SHA256

51112c067bd5c87a44698ec80bf9873160eee16b2d7c9775786e41724a06ecd7
SHA512

f89ba14f8b74c6dc82b6bcfeac57d182374a78921f29dca531de5e0bca4b2ac9eea9b4885b4ddf5cd2308319e07a333a41f3c54e8e8f9e7d7e86139858143d52
SSDEEP

393216:p8q4MTSXPXpoRiwDDymzSo6NK6ZR/tbspb16ltRmJONTshFHo6r3ELG7t:pRmXPXpoMwavN7RlbsetsiT25TdB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1920	4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118.exe
1920	4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118.exe
1920	4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b0e190b8bc86042666a041fe7ce5fa0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd895C.tmp\ioSpecial.ini

Filesize
831B

MD5
8c81904061586a31a0abcee0c2b5db02

SHA1
860c3ebf3908747e04e7b437110b1929039c8f6d

SHA256
e1c95492d3cb0d508aa394cec40dfc94a1efd4edc298e559de034c20fa32accf

SHA512
4c6d448cba00f82665a1beffa6d081da189e0d858d22ea3d2ef9be6997d59e49b4995e87d634805bb9b1a9e800e089c6f345fb938b59ed330f604afb7e00f109

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd895C.tmp\ioSpecial.ini

Filesize
883B

MD5
38ac13b1c172731e7c5fbb7c32750a81

SHA1
4f6d8e111990ef73458a3511a96520b769eae261

SHA256
cf400852efbfef4b3f98d5dbc2a2e09c5b3a633faca1503be6806b530b55f3c1

SHA512
170fef6852105b74e098818ae45bb2c086f4962fd25a7dbe5c9d4d430edf3bdb81c6cc475c6afc415a61f41a45db03a840fef5c3ce2b133035601620c51ec979

Download Submit
\Users\Admin\AppData\Local\Temp\nsd895C.tmp\InstallOptions.dll

Filesize
14KB

MD5
20f3184efe7edddfef3325efc25d12a5

SHA1
8db4c500d73f9525a7e9834df6caea2e70189939

SHA256
0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

SHA512
433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd895C.tmp\LangDLL.dll

Filesize
5KB

MD5
ea60c7bd5edd6048601729bd31362c16

SHA1
6e6919d969eb61a141595014395b6c3f44139073

SHA256
4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

SHA512
f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

Download Submit
\Users\Admin\AppData\Local\Temp\nsd895C.tmp\advsplash.dll

Filesize
5KB

MD5
669030d7919ae29999a2fd89aa427202

SHA1
870bcb7e87bbf423abcbc1c5be80f7e63720a6d8

SHA256
e1ae0a39d4d941cdfaf87f1df87f7ec50146e2e32705254e4d3618f74506bb82

SHA512
1637b854938c6b05938a3a6a06181ae70e23f6cc9a4bca4f8024db65314771197ae3d5008c83dd480ede7fec14d655dae15f439e327fc33c7b70853710621e8f

Download Submit