76b2bd579ba9723c4b9cc0ccaac2925b7dabcc337d021d26fb4e6fd786057a71

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.exe
Size

361KB
MD5

180b2ea2494b5064fcb85d2b8ea04bd3
SHA1

4e30cbd4e5b2a41b12c1999b811fda93287a2e44
SHA256

76b2bd579ba9723c4b9cc0ccaac2925b7dabcc337d021d26fb4e6fd786057a71
SHA512

2deea69692fc3bb3342fc0f076b6659796b3a96a5b263584b706ea920230f2477308f55132d44097a75dd0a16caad71953b92548e9d7586a84afd5f1fecd4485
SSDEEP

6144:N/vOM65ERltmlY424i31rZzd6ifcDjgftcWz808aBqpTnRQzbreoS280:NHOrChB5/6ifusz8kqp9QzbqoSc

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3864-0-0x0000000000400000-0x0000000000512000-memory.dmp	upx
behavioral2/memory/3864-24-0x0000000000400000-0x0000000000512000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3864	180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.exe
3864	180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.exe
3864	180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.exe
3864	180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\180b2ea2494b5064fcb85d2b8ea04bd3_JaffaCakes118.data

Filesize
822B

MD5
c08dda5501dd8dbc8f2502203764771a

SHA1
4df15a45b18af06608dbe39acc989b1043a9d2c0

SHA256
7910a61e159eed8a435fdcebb811d1e07839eedbf6b8abd0e6eef3dcafe5f8c3

SHA512
136227bba1f7f93567b6d8c57ca55b67681a70797ca253dec0628a715b7ab9a1925d8c91f76553e8dd0877c8a5eb525b531a0548c4b083bc070c6d86d6b29f32

Download Submit
memory/3864-0-0x0000000000400000-0x0000000000512000-memory.dmp

Filesize
1.1MB

Download
memory/3864-24-0x0000000000400000-0x0000000000512000-memory.dmp

Filesize
1.1MB

Download