fe0b2a6cb1698aca790ca9a65d426ea0be1682168f6783bc3bb7ca605e4cb39b

Analysis

max time kernel
67s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b5de85731cd0ead36c87a41626c9d8b_JaffaCakes118.exe
Size

615KB
MD5

0b5de85731cd0ead36c87a41626c9d8b
SHA1

bb888912f81933aa768834119b332a0a023e332f
SHA256

fe0b2a6cb1698aca790ca9a65d426ea0be1682168f6783bc3bb7ca605e4cb39b
SHA512

575c2b6da42610b781401d06bb1ee3419574d80b8ad446c1e830864822aff72b8b8a4d5d313de9e1242e0cac71f5bb720d945da8153cafdfe930edb112df3a5d
SSDEEP

12288:whkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNi4:4RmJkcoQricOIQxiZY1WNi4

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4064-0-0x0000000000400000-0x00000000004AF000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0b5de85731cd0ead36c87a41626c9d8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b5de85731cd0ead36c87a41626c9d8b_JaffaCakes118.exe"
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Adminlog.html

Filesize
621B

MD5
92c586b2267cbf64b3b919b6b321cd9e

SHA1
8d4a43e5c48338592553ab5da398c85ab228021c

SHA256
401f88c5ad2293c3cbd387cb7b8de704dd9e56c544adfe57dfa3255b79472434

SHA512
9391c9bae43c26e3d86cafad1f5f090d6830be4c8811772624705905c9a8a7df778f44240c672ff72df13b93232a6f7458d572d500874adb70e5ac54868e9897

Download Submit
memory/4064-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download