151aa89b22c5bf980bdcb90b6a3e96764af4a648ccb2a817d928566486734f77

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 04:05

Target

08fb0de9bfadc1119be7bcaa4a2c4aad_JaffaCakes118.exe
Size

1.7MB
MD5

08fb0de9bfadc1119be7bcaa4a2c4aad
SHA1

9922e49c4d08c0f14faaf5ccbde3df80122044ee
SHA256

151aa89b22c5bf980bdcb90b6a3e96764af4a648ccb2a817d928566486734f77
SHA512

e1c0a020a666831a586386cfc5fc088cd0bddf5d0b7218ec4fb882ae524b5219069410de3d330be8bd3c2d1ecb95db16b3d61175217e377d2f70dc6ad6b28542
SSDEEP

24576:YbsjGNCcaASiY/AXw0j2ioL7jXh/nCDTDQlaq40JyEVbwP72kHd:YxpaASiY/j0Cp3cTQOdEOP71

Score

7^/10

discovery upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000865000-memory.dmp	upx
behavioral1/memory/2200-2-0x0000000000400000-0x0000000000865000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	08fb0de9bfadc1119be7bcaa4a2c4aad_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\08fb0de9bfadc1119be7bcaa4a2c4aad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08fb0de9bfadc1119be7bcaa4a2c4aad_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2200-0-0x0000000000400000-0x0000000000865000-memory.dmp

Filesize
4.4MB

Download
memory/2200-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x0000000000400000-0x0000000000865000-memory.dmp

Filesize
4.4MB

Download
memory/2200-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download