a4e10fe06bb5202f8b07f3264adf23bd3d3825e214fef6b096adbe5d6a530e91

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe
Size

1.2MB
MD5

61901604ebf438822f721a051bdf4f53
SHA1

e7a3fe6b12a188d8f352a259e1a7a78310cc3460
SHA256

a4e10fe06bb5202f8b07f3264adf23bd3d3825e214fef6b096adbe5d6a530e91
SHA512

fb0ea549b0f2101954b1247bec2ad74ffa2c67bafeb7973746e342be0cdc3090e1ade6722ca577a574223e304076ba488a0e10f537673613e7c843a02b21a484
SSDEEP

24576:nMM7up2lA3/eU93w26xznXN0fyaU3iPeuBqpwiwuNPITldbWn1mBbeIk:MklGWUFw5DN0bGuUp0u2Jw1mBbeIk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2720	Setup.exe

Loads dropped DLL 5 IoCs

pid	Process
2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe
2720	Setup.exe
2720	Setup.exe
2720	Setup.exe
2720	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000c000000012275-2.dat	nsis_installer_1
behavioral1/files/0x000c000000012275-2.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2720	2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2720	2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2720	2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2720	2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2720	2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2720	2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2720	2784	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Setup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjF24C.tmp\ioSpecial.ini

Filesize
566B

MD5
e6952f71b9bad3446e5279226781c94e

SHA1
1ada82d82160ba5241927574e964ac998eaf5e64

SHA256
fa06ab59f9d7bb451e13812fa51c83870b1cdc8a59281b72de55b23ae538be82

SHA512
a2cb3a8b9734f31b583dd3f1900efafb5a918cd431aa5833f62bc5f1d1b3aaa298ed70de9f2bdbff14e0e28f196f1f3bdc431cfd82310c48f42c48e58c7f785c

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF24C.tmp\InstallOptions.dll

Filesize
15KB

MD5
9a886711c559308c39c01c20e9d9a1e3

SHA1
0f27cf1cf6e4960e140651b68d72ed4b92c58e9e

SHA256
98be8860d38ad9cf31b55a1a04594de59eabad67510ba2a33ed20a80863ddfa4

SHA512
4dabdd9ea7a8330a367589a3975a9dc7286b82c66efc7db118b4d7a2db08a467851c6d3dc991668e13c4dd5473aa974e9696a2226039db94df8b198da54354a3

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Setup.exe

Filesize
1.1MB

MD5
357a8dd0433cde3759f13b42f493c4e0

SHA1
2ba4a971e1d398589233e770030581a9767d4240

SHA256
2b4aa368f9b1363aa19b9de02f1b41fabde07d2359014eb456746cd7d66aba2c

SHA512
ce0432ce668dc60841832b0c14babd4e77a055709d9e0d027a51c2c6b500d99348f71d9aea2f1846781623289845a6690c037b8a1a40da97402f34651ba86488

Download Submit