Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 01:19

General

  • Target

    d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe

  • Size

    83KB

  • MD5

    d56e7a8e14d2b01a4f76df979b78fa0b

  • SHA1

    e4697c9be78fd6a2fb38313b3c6c28e196d74b97

  • SHA256

    45b6ccc9ef099824147337d1896abae64507649e52ae989332ef07dd60c1f748

  • SHA512

    7e9dd3a9430ef6281b1114022a1e51c9750a2890747861b5ebe65b3821810483c92317ffee39524de1e937b400a031aec9acf6feae2e4a7227813acb99e3a28f

  • SSDEEP

    1536:3EkjY1zy214Qay0DGkJ7qAELVigJGKcpp0bUYr9H63dZZ2/DoO:UkjAJ4dDGkJ+AI0drsUYk3d6/t

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d56e7a8e14d2b01a4f76df979b78fa0b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsc98F5.tmp\InstallOptions.dll

    Filesize

    13KB

    MD5

    d765c492c21689e3d9d61634371fd861

    SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

    SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

    SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • C:\Users\Admin\AppData\Local\Temp\nsc98F5.tmp\System.dll

    Filesize

    10KB

    MD5

    fe24766ba314f620d57d0cf7339103c0

    SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

    SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

    SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • C:\Users\Admin\AppData\Local\Temp\nsc98F5.tmp\ioSpecial.ini

    Filesize

    619B

    MD5

    3d2b4147fc792e9d5c23c2a5010d3841

    SHA1

    e60f15703c8cfc6666abfc20e87a5383dcfca27f

    SHA256

    1945bc765fb95848a1595faed311ef6747812e67251d78e17f9a72d30b41e40e

    SHA512

    fad674a500f2eb49b8d0f8a9498cee4560a62c2ee3de601700fbd6a2618ead6e8a710582ba49d414a8a353ef5814500a68945a0f91c98a4a6c8cb58ae6347bc7

  • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    83KB

    MD5

    d56e7a8e14d2b01a4f76df979b78fa0b

    SHA1

    e4697c9be78fd6a2fb38313b3c6c28e196d74b97

    SHA256

    45b6ccc9ef099824147337d1896abae64507649e52ae989332ef07dd60c1f748

    SHA512

    7e9dd3a9430ef6281b1114022a1e51c9750a2890747861b5ebe65b3821810483c92317ffee39524de1e937b400a031aec9acf6feae2e4a7227813acb99e3a28f