2aced4f2c1d02ded413ffd3d9aee833324c39cc79d43f9083d429c404758ec9a

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eccca80b9099b89a9426c1d159daee16_JaffaCakes118.exe
Size

342KB
MD5

eccca80b9099b89a9426c1d159daee16
SHA1

9ffe3134ba77b4ce75cc1aa50283667129949c28
SHA256

2aced4f2c1d02ded413ffd3d9aee833324c39cc79d43f9083d429c404758ec9a
SHA512

9f05061863dc82740174e3c5eb566a5e43856e00ad7ff3f562adf13186421463e62c1ab187ed09d9958d33300644eca370ae4725f12ab55deccf6d014fc4e906
SSDEEP

6144:hlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76l1fuF+RDsFqFl7vE3e:hHLUMuiv9RgfSjAzRty12dcF5vEO

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3436	eccca80b9099b89a9426c1d159daee16_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3436-0-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral2/memory/3436-17-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral2/memory/3436-22-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral2/memory/3436-30-0x0000000000400000-0x00000000004B2000-memory.dmp	upx

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3436-17-0x0000000000400000-0x00000000004B2000-memory.dmp	autoit_exe
behavioral2/memory/3436-22-0x0000000000400000-0x00000000004B2000-memory.dmp	autoit_exe
behavioral2/memory/3436-30-0x0000000000400000-0x00000000004B2000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\eccca80b9099b89a9426c1d159daee16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eccca80b9099b89a9426c1d159daee16_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypt.dll

Filesize
4KB

MD5
d837210daced01236ccc50baeb996f51

SHA1
2f9dee67b1af7e5a32cd10358356fcf87fcf5ada

SHA256
547ab733bd5d60e0bd0e31cb26649a8d5b80e10f2996c9bff21b026dd4494454

SHA512
935b3e7f5991537c0b053e3e961d74fc95f7902e916b2b88791482d20656435e43882ce75de1cc7312784e4de50c63a0d163a875b541cc0bd6e760a2e0751c00

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut8CB0.tmp

Filesize
67KB

MD5
9ce5b22b1d0ca46e42e96f29b9dbcc9a

SHA1
3c3e0928c69478262127b5dcb22e16e3e1f9f4f5

SHA256
4dc4f1b91e2e470c435be8b1563fe0fd956f945df1a255cf173e7ddbf46ae6ac

SHA512
365cc6b46cc857be1f04adc63bf32447483b9332a77f6acb650740f564c956d613b4161c138a908d1e85675e6e6f4ea7e3970102601b9051ec0b73d4d282fa37

Download Submit
memory/3436-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3436-17-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3436-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3436-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download