24a22d5a5180597ea0b975db604c1bba28e12c6098bea4289be4f28be86fd7c5

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:27

Target

694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe
Size

56KB
MD5

694922c57a6f4ee6beae62cab5c03c4a
SHA1

b1b90d5f023d90a410dbf9555ba04fa1ebbf07f4
SHA256

24a22d5a5180597ea0b975db604c1bba28e12c6098bea4289be4f28be86fd7c5
SHA512

7eb51795b3e1cafc0bb364f205cc6ac812a6a3ca141010dd2e20a489fd9f219048a247ef70e43100101a70d65713dec59a0268ed9271a684bfbfbfc20ce1c983
SSDEEP

768:ex777+1iMiMCSIeqX9Ds7+ClJcZ4Tb3Hjn2SwX7Gup3wO2xOwbP6vYWpYpNYlEbj:exr+zgKaDsaicZ43pwiup3nYWeD0EbV

Score

7^/10

upx

Drops startup file 1 IoCs

Processes:

694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PicoPhone.lnk	694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2240-1-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2240-4-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2240-12-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2240-18-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe"
1⤵
- Drops startup file
PID:2240

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2240-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2240-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2240-3-0x0000000002290000-0x000000000229F000-memory.dmp

Filesize
60KB

Download
memory/2240-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2240-6-0x0000000002290000-0x000000000229F000-memory.dmp

Filesize
60KB

Download
memory/2240-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2240-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download