Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 07:06

General

  • Target

    38ddee5912bab8e76122fed1d375ec29_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    38ddee5912bab8e76122fed1d375ec29

  • SHA1

    50fa741c44b9b063fd9975267ca44c85e7983440

  • SHA256

    23ac5cd4a9b66105fae9ab8efed66d8f211311330706a6c6f078d19e1af9618f

  • SHA512

    37cd7db1be063e135fed846a90f37527caf6138f0bd943376d1a7446ee1743635702a01151a3bea9f339b38722803918e7180c4f9fb3e1dea6af5675a080a56f

  • SSDEEP

    24576:8Mha4mEoG+N4i3NJeATkKEOcD91aA0N8jEVgFMyzAPjQ:8MUbEoPSidnTeHCAj5zAP8

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38ddee5912bab8e76122fed1d375ec29_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\38ddee5912bab8e76122fed1d375ec29_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2888-0-0x0000000000400000-0x0000000000754000-memory.dmp

    Filesize

    3.3MB

  • memory/2888-1-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2888-2-0x0000000003460000-0x0000000003461000-memory.dmp

    Filesize

    4KB

  • memory/2888-3-0x0000000000400000-0x0000000000754000-memory.dmp

    Filesize

    3.3MB

  • memory/2888-5-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2888-6-0x0000000003460000-0x0000000003461000-memory.dmp

    Filesize

    4KB