Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 17:54

General

  • Target

    bee2d07e102a5049e0d155b49e1f68b6_JaffaCakes118.exe

  • Size

    62KB

  • MD5

    bee2d07e102a5049e0d155b49e1f68b6

  • SHA1

    45f8d9cb54ac88d53e71888f29d14c29ff72b15b

  • SHA256

    bb868006817fcfd699c634ed8e75ae193d85171389fd64f16dd552ddefe4ca77

  • SHA512

    6c3db1bc5e434c8887a1ac1e49f4e1f41f9487c88e3ecfdda8d91545018a8fd7c4f88ccb1fd9bfcfd0badd71b5f13109ab2af3ad272048202a4400db1d4acb37

  • SSDEEP

    1536:b7wc1aGNC0klI7CPpIFa6rr/wteXaC00XQM+wE:b7wc1aOCo7CxI/raeXT00XQM+f

Score
7/10

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bee2d07e102a5049e0d155b49e1f68b6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bee2d07e102a5049e0d155b49e1f68b6_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:3276

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ICQ 4 Lite.exe

          Filesize

          62KB

          MD5

          bee2d07e102a5049e0d155b49e1f68b6

          SHA1

          45f8d9cb54ac88d53e71888f29d14c29ff72b15b

          SHA256

          bb868006817fcfd699c634ed8e75ae193d85171389fd64f16dd552ddefe4ca77

          SHA512

          6c3db1bc5e434c8887a1ac1e49f4e1f41f9487c88e3ecfdda8d91545018a8fd7c4f88ccb1fd9bfcfd0badd71b5f13109ab2af3ad272048202a4400db1d4acb37

        • memory/3276-0-0x0000000000800000-0x000000000080E000-memory.dmp

          Filesize

          56KB

        • memory/3276-3-0x0000000000800000-0x000000000080E000-memory.dmp

          Filesize

          56KB