a4e10fe06bb5202f8b07f3264adf23bd3d3825e214fef6b096adbe5d6a530e91

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe
Size

1.2MB
MD5

61901604ebf438822f721a051bdf4f53
SHA1

e7a3fe6b12a188d8f352a259e1a7a78310cc3460
SHA256

a4e10fe06bb5202f8b07f3264adf23bd3d3825e214fef6b096adbe5d6a530e91
SHA512

fb0ea549b0f2101954b1247bec2ad74ffa2c67bafeb7973746e342be0cdc3090e1ade6722ca577a574223e304076ba488a0e10f537673613e7c843a02b21a484
SSDEEP

24576:nMM7up2lA3/eU93w26xznXN0fyaU3iPeuBqpwiwuNPITldbWn1mBbeIk:MklGWUFw5DN0bGuUp0u2Jw1mBbeIk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1472	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1472	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a0000000233f4-3.dat	nsis_installer_1
behavioral2/files/0x000a0000000233f4-3.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1472	4872	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	85
PID 4872 wrote to memory of 1472	4872	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	85
PID 4872 wrote to memory of 1472	4872	61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61901604ebf438822f721a051bdf4f53_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Setup.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa7A13.tmp\InstallOptions.dll

Filesize
15KB

MD5
9a886711c559308c39c01c20e9d9a1e3

SHA1
0f27cf1cf6e4960e140651b68d72ed4b92c58e9e

SHA256
98be8860d38ad9cf31b55a1a04594de59eabad67510ba2a33ed20a80863ddfa4

SHA512
4dabdd9ea7a8330a367589a3975a9dc7286b82c66efc7db118b4d7a2db08a467851c6d3dc991668e13c4dd5473aa974e9696a2226039db94df8b198da54354a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa7A13.tmp\ioSpecial.ini

Filesize
566B

MD5
8168ee89a90860adefce31f05dd615b3

SHA1
357409e3264c817c05792240e1e46a3f47930b17

SHA256
48096e45c91af485e9c2c60908fb3658a0d5dcf83eb711f4b7af972f74c0bab9

SHA512
a4dbf91c118b26bdeff969bfddacca411294b129df4cb977b9ad0b95ad811aaa04ca8779492e66be803a0709da5e15898789202f3fdf429587d5854ca8defd7f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Setup.exe

Filesize
1.1MB

MD5
357a8dd0433cde3759f13b42f493c4e0

SHA1
2ba4a971e1d398589233e770030581a9767d4240

SHA256
2b4aa368f9b1363aa19b9de02f1b41fabde07d2359014eb456746cd7d66aba2c

SHA512
ce0432ce668dc60841832b0c14babd4e77a055709d9e0d027a51c2c6b500d99348f71d9aea2f1846781623289845a6690c037b8a1a40da97402f34651ba86488

Download Submit