d0f5829601cfccf94cd693c813f720b2c62a1d11a0c5de6e544a7cdac5251b18

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe
Size

670KB
MD5

5ab5d439876f093f5fd7a4f2b015b4be
SHA1

2710bb80f6c8d5eafcde9914743d2f217299eb2f
SHA256

d0f5829601cfccf94cd693c813f720b2c62a1d11a0c5de6e544a7cdac5251b18
SHA512

a2cc472a017bf70e112b99ab7b0b40144b693beb4e3e438113d15dbd10af149b17c9d2a21af0a750b2d1a81070489b4a94b9a04ab5528b8618b4556efca5c910
SSDEEP

12288:3Bi3pbKz9v0gBkqAzf+92bl06KZSnsPMx2VmXVmV+Xxde6dBX:3BiFKzffTMbl06sw2VmEV+2q1

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2168	5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyE715.tmp\ioSpecial.ini

Filesize
630B

MD5
38c406ae6be71b096972e01269348922

SHA1
2375be00b619b941814473a2f78b693ddfaf1206

SHA256
461d2313a72a7c7158ece71c59d7ca11bd36433323ce53d55a9d837b72cd1709

SHA512
acb900f9f9d4167cd47ee4babcc3ef9edbadf678bdff6af3785438d56d227f3bd7161c07b4433baf68646861ffdfd8dcbd1e45bc1fe42ed05e955f9a9be595ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyE715.tmp\ioSpecial.ini

Filesize
591B

MD5
f7f075a43b05f8516aafd67fe462c972

SHA1
4d69eba0a7dc33135547c6483104575ca1088ad4

SHA256
500a00ded8a7c46629e4227f9b8a45b0fbf51f7e6fe10e99cfe1711786ef4440

SHA512
8c6be882c173c3a070dc53a788f38d91915e73e08c94f8c50ffa66d7f4fed998f5f80bfaf5208cb4498ff77645c390eec7a58acbe0d6af409d3c4d8b1f7b711f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyE715.tmp\InstallOptions.dll

Filesize
14KB

MD5
fa5beae80dba254fb6c21b58265f5310

SHA1
f2f776611dbbb157b151aa744a7e0be1d4b8c079

SHA256
34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269

SHA512
7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538

Download Submit