8ef8966a875cbad9a45f07de83771c2bdddb8f776241db410240d6c3ca20314d

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49963e837dfa05a5b1e739e3abe8dfd9_JaffaCakes118.exe
Size

57KB
MD5

49963e837dfa05a5b1e739e3abe8dfd9
SHA1

30370d444435f9b5aaa116724aa1dc170c54f3ba
SHA256

8ef8966a875cbad9a45f07de83771c2bdddb8f776241db410240d6c3ca20314d
SHA512

a85ecae31db41cb7df8bf7cf041596fb166b836643f40176f847aa4b5bc8f6a6bed98d0e64c5019d0d90be4b2675656d41a0e77b9e8db5abdbe63dc85d254872
SSDEEP

768:3QPR+dx2IT5wkcVp+1+sA+uFQR5tIHn0ZWUOa57L7/LmJxva+aTJOo6:3kIv2IT5w75sLue2HInZVak+aD6

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2576	49963e837dfa05a5b1e739e3abe8dfd9_JaffaCakes118.exe
2576	49963e837dfa05a5b1e739e3abe8dfd9_JaffaCakes118.exe
2576	49963e837dfa05a5b1e739e3abe8dfd9_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2576-0-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/2576-22-0x0000000000400000-0x000000000052E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\49963e837dfa05a5b1e739e3abe8dfd9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\49963e837dfa05a5b1e739e3abe8dfd9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse5110.tmp\NSISdl.dll

Filesize
17KB

MD5
f5e0895cc52e25fd5a0d6f2b6cb4a530

SHA1
41918b149fbcfd0434c78bf70be8d06d116795a4

SHA256
1a2404b38399ecc54cdcac303adf49cb615a02093fa181c6f9413aba11cf65ea

SHA512
247901efb560d717f0c9b3eb19b26cedf28f9d3239a3cdb0e6b77a03246e50572f8a4fffd09f46c8677d67e9704ecfdbb476714d036eef4654e0f4a3b12a70ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse5110.tmp\System.dll

Filesize
16KB

MD5
b229694657d51375d45d2fe5bd2a0616

SHA1
4fd6e5ce354f7d72613213c57c20d362c11d4d2f

SHA256
36eb621d65ed1236d4e1b8cb01dd39cc69ab5052f227fb21694830e60703a739

SHA512
fcf47391964d90ac52ceda9a6cdfddea60ab09c251ebd89f48443a1880817f89b9d0db2d1830b7ad17787e4df9a534aea8e7fd826cef2f677b7c2e693bbdf4da

Download Submit
memory/2576-0-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2576-22-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download