dad07819cf10e0c224b15b874e0278fb5e851601f52a4d00b173b5c405c18b5c

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b5223b206848661edf56172340281a8_JaffaCakes118.exe
Size

3.6MB
MD5

4b5223b206848661edf56172340281a8
SHA1

0b1cf71ae15fc2d703a8fd73651ddd6dd96f0f39
SHA256

dad07819cf10e0c224b15b874e0278fb5e851601f52a4d00b173b5c405c18b5c
SHA512

cff498531d441f206dafa04424493b27e3133b42785becc6ac1cabdaca7761a9cbcfb0b7f49b6bf9ca5dacf3dbd1050872e1d00608e7d400fad8061d6df7152a
SSDEEP

49152:i0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIakLmEe:i36ivJDiSFdph1mPYAlO/hJ6ZYWwqn9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1600	InstGameInfoHelper.exe

Loads dropped DLL 3 IoCs

pid	Process
3852	4b5223b206848661edf56172340281a8_JaffaCakes118.exe
3852	4b5223b206848661edf56172340281a8_JaffaCakes118.exe
3852	4b5223b206848661edf56172340281a8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1600	3852	4b5223b206848661edf56172340281a8_JaffaCakes118.exe	85
PID 3852 wrote to memory of 1600	3852	4b5223b206848661edf56172340281a8_JaffaCakes118.exe	85
PID 3852 wrote to memory of 1600	3852	4b5223b206848661edf56172340281a8_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\4b5223b206848661edf56172340281a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b5223b206848661edf56172340281a8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\InstGameInfoHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\InstGameInfoHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\InstGameInfoHelper.exe

Filesize
99KB

MD5
3d3d2bf9c42dbdf97247775c00f22190

SHA1
7a046170aaeb5e1a29d8c8cd7c32225f49237aa1

SHA256
59f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a

SHA512
6e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\ftdownload.dat

Filesize
512B

MD5
28c1ac550c09a03dfd2a7b95c624ab0b

SHA1
b800420329c92a0fe6310f1ee429fde43eb38e85

SHA256
b1a130b71dcc388ef3ef865ce94b7479e07e92a0ec5363319296ab5cf1ae36a5

SHA512
6dd3859ab13e5b97572e4bdff67030220d8e6a2bd45d8d83917c5b774842f8d399f8323bb7852293142723ef2b72b65e873b2cf12976cf9b42d601c9b1fa3afc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\gametitle.txt

Filesize
24B

MD5
91bbf79dd26c5ab6a2f8fac8db58beac

SHA1
cc8f5755e22637f90f865b9993c691a7caa57111

SHA256
34d6f1744136113a6386060fc34f0b58cbd48232282ac77f434df4d8f23e1682

SHA512
3b24325f676724c99ba0d81c5e2029a5db297853929d7b1ae3a1a2ba496177f83daa6e361b32309a75781ac73850d43a333c97e944db5a8b28ef487b0a20efce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq87CE.tmp\tn_feat.bmp

Filesize
4KB

MD5
aaeff1442865fbdb5a19b15018ab5b8a

SHA1
a22773696b615cfb4ceb06f1b441696bef2fd49c

SHA256
6da8cc04ec6c41c072e534d4e0b49ff82ece30eab2097a77fb055e135a44cc2a

SHA512
b7a2e3009cf4cbe6974d4cd652943e4fbbd432299510f5465a5900851b5031d8a6034d2698be43c9a5da601d661f2c21dd89a42bc2ad4d464db6ab32f15cf0cf

Download Submit