8668ad831fa5e591bb1fec066d3f908524df2d4a6017c80077ae0a5961758382

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
Size

153KB
MD5

658b5d3b08863c5580c1d6cc8e949614
SHA1

ced34635e3682175b4118df8fad8e1c47b51df6c
SHA256

8668ad831fa5e591bb1fec066d3f908524df2d4a6017c80077ae0a5961758382
SHA512

49431cf35b87d54b194d051ca5b580315d2da7ab0f1af35110f08906c8c541a6969c58354addee43ae1353a46d8974c30c254cdcb9a4b26f5f4c978b904ecfc2
SSDEEP

3072:vCQHshN8TmQ+fN6V+kr9d+TpvDbTDp1BsSytZCnSnh:NshzQ+4VX+TpHHiSytZV

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

pid process

2500 658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
Loads dropped DLL 2 IoCs

Processes:

658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

pid process

2172 658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
2172 658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

pid	process
2500	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

pid	process
2172	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
2172	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\Temp\MT\658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe	upx
behavioral1/memory/2500-13-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral1/memory/2500-16-0x0000000000400000-0x0000000000439000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

description	pid	process	target process
PID 2172 wrote to memory of 2500	2172	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
PID 2172 wrote to memory of 2500	2172	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
PID 2172 wrote to memory of 2500	2172	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
PID 2172 wrote to memory of 2500	2172	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe	658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\Temp\MT\658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe
"C:\Windows\Temp\MT\658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\MT\658b5d3b08863c5580c1d6cc8e949614_JaffaCakes118.exe

Filesize
91KB

MD5
c5c6ddb5d86f59f23fc07ed229dbf534

SHA1
51fd16551d51436836ebf0818c1f02e443c32754

SHA256
871aaab301e9c40fe24a8ccab1fa64f86547b50fb4860da1ca979fffd36c1a82

SHA512
04f38c77b30120e8595cebb7803842a63597b119c0f24fcdea2a2a657acfe4469a326937730c334816a934100d1a4c644c5a5e79c38edd107de13e984c10ff49

Download Submit
memory/2500-13-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2500-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download