Analysis

  • max time kernel
    144s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 11:07

General

  • Target

    2491cabf30cf684a80ec6531ac361c4f_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    2491cabf30cf684a80ec6531ac361c4f

  • SHA1

    ec2afed86334a70dc2aebee7463b88f914f7dfa7

  • SHA256

    101766bb94797dccc6cbb3f4de28ab0b71c24a4e846be9ec53749c80d1d3d890

  • SHA512

    071749956704d8687b9980fa0199069cad7d0029f25cd7f8a2a2edc7d575623633c94f643a7043643c6fc43faf6cb59a159c702e033030460e06f05a7252e131

  • SSDEEP

    24576:OMwN2RTkr4kTtgTZ3oj3RWNWx4JQgWpqXGnn2ALCvND:OMPktEg3RWN7qwunHCvN

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2491cabf30cf684a80ec6531ac361c4f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2491cabf30cf684a80ec6531ac361c4f_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2548

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2548-0-0x0000000000400000-0x0000000000799000-memory.dmp

          Filesize

          3.6MB

        • memory/2548-1-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2548-2-0x0000000003800000-0x0000000003801000-memory.dmp

          Filesize

          4KB

        • memory/2548-3-0x0000000000400000-0x0000000000799000-memory.dmp

          Filesize

          3.6MB

        • memory/2548-5-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2548-6-0x0000000003800000-0x0000000003801000-memory.dmp

          Filesize

          4KB