1b65205786897fbee955059cadc973a8ffdfb23f4a28cc1ac50a85518947f8b6

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe
Size

3.5MB
MD5

4b502d8ee87f68f49a710a0d3b7496fa
SHA1

64be00d1fe50dedad00f9f523e48c533c2d0f03b
SHA256

1b65205786897fbee955059cadc973a8ffdfb23f4a28cc1ac50a85518947f8b6
SHA512

f2fb0a8c94890130534cd4e359305249d26fa53d8a3a3d567ef377f8ab51b0771d8aa4f8cc3379d0d6014f45a1f1b2fb076b26fc9b96d8c32451a1092e66836c
SSDEEP

98304:CBKGCSX1RPGVgz1Rt51W+TDDImzolmdydV2qt+vU7aUDcBCgyMO:CBKGlX1RlRt51W+TZzolmdwXt+szDc03

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
552	4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe
552	4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe
552	4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
552	4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe
552	4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b502d8ee87f68f49a710a0d3b7496fa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nspAB65.tmp\tools.dll

Filesize
236KB

MD5
e12f05661436f2974cf91b5fc76fb5f4

SHA1
5e0b7887950204713bef3da0018911279f2540ec

SHA256
1873de723938193f9f0877b08c160884b79503b6607598158ad99bd909189fdc

SHA512
61d42e055865dd98552b29dd69dc3d761bc7f77c1af108ad13b0b390059be5668657645258c0c08052a5fe1e9f6bdb018da136eb103b7335097487ec0de5d22d

Download Submit
memory/552-19-0x00000000033F0000-0x0000000003400000-memory.dmp

Filesize
64KB

Download
memory/552-20-0x0000000074612000-0x0000000074613000-memory.dmp

Filesize
4KB

Download
memory/552-24-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-25-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-26-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-28-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-30-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-31-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-32-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-33-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download
memory/552-34-0x00000000033F0000-0x0000000003400000-memory.dmp

Filesize
64KB

Download
memory/552-35-0x0000000074612000-0x0000000074613000-memory.dmp

Filesize
4KB

Download
memory/552-36-0x0000000074610000-0x0000000074BC1000-memory.dmp

Filesize
5.7MB

Download