f7c728dad66b3b96191b81d0ac03d7fab708cf4b072bdabcafa94827e3d2be2f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1167458a915a4be59dd6e9cd8c59bed4_JaffaCakes118.exe
Size

57KB
MD5

1167458a915a4be59dd6e9cd8c59bed4
SHA1

c21cc3f2f4698456ea678dabedf39da5a3af65b4
SHA256

f7c728dad66b3b96191b81d0ac03d7fab708cf4b072bdabcafa94827e3d2be2f
SHA512

475280ab0ccc80c34c107cce6f7af1dafdbacac5e13afab1321c913e75063ff750cce2bf49c40909d4365157108fc341bffdb2542eb711bf38214b1a148ecba3
SSDEEP

768:noQPR+dx2IT5wkcVp+1+sA+uFQR5tIaFZcaIFY67sRnAiUvVRl2eTJOcV:nokIv2IT5w75sLue2aFT6ynAiKVRl2eR

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1460	1167458a915a4be59dd6e9cd8c59bed4_JaffaCakes118.exe
1460	1167458a915a4be59dd6e9cd8c59bed4_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1460-0-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral1/memory/1460-19-0x0000000000400000-0x000000000052E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1167458a915a4be59dd6e9cd8c59bed4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1167458a915a4be59dd6e9cd8c59bed4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst29C1.tmp\NSISdl.dll

Filesize
17KB

MD5
f5e0895cc52e25fd5a0d6f2b6cb4a530

SHA1
41918b149fbcfd0434c78bf70be8d06d116795a4

SHA256
1a2404b38399ecc54cdcac303adf49cb615a02093fa181c6f9413aba11cf65ea

SHA512
247901efb560d717f0c9b3eb19b26cedf28f9d3239a3cdb0e6b77a03246e50572f8a4fffd09f46c8677d67e9704ecfdbb476714d036eef4654e0f4a3b12a70ed

Download Submit
\Users\Admin\AppData\Local\Temp\nst29C1.tmp\System.dll

Filesize
16KB

MD5
b229694657d51375d45d2fe5bd2a0616

SHA1
4fd6e5ce354f7d72613213c57c20d362c11d4d2f

SHA256
36eb621d65ed1236d4e1b8cb01dd39cc69ab5052f227fb21694830e60703a739

SHA512
fcf47391964d90ac52ceda9a6cdfddea60ab09c251ebd89f48443a1880817f89b9d0db2d1830b7ad17787e4df9a534aea8e7fd826cef2f677b7c2e693bbdf4da

Download Submit
memory/1460-0-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1460-19-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download