40486739b5d46f4f3472932563f7f01ee63585f66ba5c41f832af123ae2028d7

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f103210174ca562e80f82a94f5e0acd2_JaffaCakes118.exe
Size

1.6MB
MD5

f103210174ca562e80f82a94f5e0acd2
SHA1

06934e885ecb4d7ca80a169cf818b6d01b616838
SHA256

40486739b5d46f4f3472932563f7f01ee63585f66ba5c41f832af123ae2028d7
SHA512

8ff8b65cbbec1ddd57442962a17dfd3e6d918c3047ff7e676c645a03185ec68e2c0b9c82feb0f757beafd0f0ed3e6286e063fd5840c4dd3b6a2ed0cfceb3cc55
SSDEEP

24576:Q0DijvqNVh00DtKimip7kLHmkrSUbonNRW01h0a7PbEMSghnvbwLcm5y0K/pieEo:QMvt5nkLt2U0WSN7o3gVMgm53aFSqRN

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/856-0-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/856-1-0x0000000000400000-0x000000000043E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f103210174ca562e80f82a94f5e0acd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f103210174ca562e80f82a94f5e0acd2_JaffaCakes118.exe"
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/856-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download