Analysis

  • max time kernel
    137s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 05:49

General

  • Target

    6a75b4bed748294856051735cfe2cfcf_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    6a75b4bed748294856051735cfe2cfcf

  • SHA1

    1067d9e569618c827abb34a7ddb6742f72e937a1

  • SHA256

    c1b9b1cf79fe82dc05c78d722eb15b11838825289785917ab040e53933b937f0

  • SHA512

    f016d9c9fa41e67c0c6080a4437a04426646b6354915b559616bc66b32d01e7fafade145de59e58c7b6b6b00dcb4fb0d9b0ec602823088cdcfbc36aa166ec0ea

  • SSDEEP

    24576:F8c3qcSKNn1oJ62UAgwBSCOqS3gSdcFlgYX3Mgs/y0h3qOI+vKktDRbzLfK92VVq:EIR1oJ62b7BSCSQ9lR35X0Bao9K2V

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a75b4bed748294856051735cfe2cfcf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a75b4bed748294856051735cfe2cfcf_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsn80BA.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    eef9e469e8a30717974499f277d97e2a

    SHA1

    2d33c25984ebd9116beeb55cdde4c5c86c023e5d

    SHA256

    1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

    SHA512

    d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

  • C:\Users\Admin\AppData\Local\Temp\nsn80BA.tmp\IsVista.dll

    Filesize

    44KB

    MD5

    344d13fd0fdd2d97e8d61960f40a8a30

    SHA1

    3f0f120203005eea3e8ed1652a6ea8a607ea934d

    SHA256

    17bb3331e2300aa01666fbee98b9552cec5e46212a4c5a340c0370b93df88f83

    SHA512

    b4e49c58503532e270cc369f1cbd14d85edd46da5ab034dad730bd4297887dd541d445d2fbf205820e6afbbdba7ab6d5b78b694467554320fd6db8e06fe4f719

  • C:\Users\Admin\AppData\Local\Temp\nsn80BA.tmp\ioSpecial.ini

    Filesize

    697B

    MD5

    b79a7c089449c45793619d9c4c628175

    SHA1

    8130433ef8752273fc443f0dafc83c84956a6205

    SHA256

    e3ee3a96adeddb01efd716e2703b29989f39649d3f3397710085c7681836edc6

    SHA512

    ce8dade57d05d094c7eb50f2e2d097c1f7bc6c88e1e2e1e6388c47d1f26beffc935d1914e7cc34ca6f68f4e2b2c1259147fa04ebe4b241c7d22f379eaf3243b5

  • C:\Users\Admin\AppData\Local\Temp\nsn80BA.tmp\ioSpecial.ini

    Filesize

    671B

    MD5

    e0cd15eba21caccab166d403268b3092

    SHA1

    b9fe57fb1dd84f9e2aeeb8a4b9e511ee19dce91c

    SHA256

    3298ec497dc7b4e1fe2c175f23e7979b79aba225077505ccbf7df4fc4ef7e454

    SHA512

    56a0984465b2c308963d91871d05dbc4efd849384808e68b4ae927336fd114370a21b5ee7910279d0a06caa7d00ecfcf8865cacb878ffee0e60ee4cdf3ecd385

  • C:\Users\Admin\AppData\Local\Temp\nsn80BA.tmp\ioSpecial.ini

    Filesize

    697B

    MD5

    78a309931ff0487f7fc0a558219271ba

    SHA1

    25bf8d00ff86478f638e8eac92bf59c3dc54013a

    SHA256

    3a4e44c49886a6136dfa8eeea3b1b664f90783b391b96d2019795a8f3e62acdc

    SHA512

    5b918d696c3032fa811b0c27fb2c21d095fe262224ef83b6b16ce94750b5e7bf1967d9fad2f647d15d8db158d99f97312bb6bdea52a54df0f84c43a0b1442291

  • C:\Users\Admin\AppData\Local\Temp\nsn80BA.tmp\stack.dll

    Filesize

    10KB

    MD5

    0f61a81a543822de5fcb9a8a43f230dd

    SHA1

    d01d4a0f542f3c654637fdfe5a574fe1f150ece1

    SHA256

    46b4a72ae8590b0afb3304cc5c13db0502bc4c4cb02f64f37c79008c17db814f

    SHA512

    596b7a897ba64c32e26ba6168aa3628aad37b187a9814a286298307d8c42eabf8e8a679dbda558f8b2cdc8676c94ec819256432aa5ad7c05a5387759262a4402

  • memory/1728-10-0x00000000022B0000-0x00000000022BC000-memory.dmp

    Filesize

    48KB