a8fe9d8109f0da2736e3c7a6fb5e98b29f834725a52da301d0cac2dc841542e3

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll
Size

11KB
MD5

e78e8879aa3602eb81bdc473a14e6d29
SHA1

8f9788c6169fe8940423f2a3807ed90f9138d538
SHA256

a8fe9d8109f0da2736e3c7a6fb5e98b29f834725a52da301d0cac2dc841542e3
SHA512

ae0f665b526adab1619f22ac245b827c0358ec6cf5c8d946f39034af6baf51edfc3ebd0d9dcc0c2c7de0d04915a23044b0e3d99851e6e2451ec2d0f883d611b7
SSDEEP

192:nr4h1oj/ed/ma5dFpbXRO71NXXn+Y+uZSFlFnQ3pLy4RL2c1sdqixmOMfczAL:UjorUm8iNHn+80Uy4N2z1AY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3200-0-0x0000000000560000-0x000000000056E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3200	3244	rundll32.exe	86
PID 3244 wrote to memory of 3200	3244	rundll32.exe	86
PID 3244 wrote to memory of 3200	3244	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll,#1
  2⤵
  PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-0-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download