24a22d5a5180597ea0b975db604c1bba28e12c6098bea4289be4f28be86fd7c5

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:27

Target

694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe
Size

56KB
MD5

694922c57a6f4ee6beae62cab5c03c4a
SHA1

b1b90d5f023d90a410dbf9555ba04fa1ebbf07f4
SHA256

24a22d5a5180597ea0b975db604c1bba28e12c6098bea4289be4f28be86fd7c5
SHA512

7eb51795b3e1cafc0bb364f205cc6ac812a6a3ca141010dd2e20a489fd9f219048a247ef70e43100101a70d65713dec59a0268ed9271a684bfbfbfc20ce1c983
SSDEEP

768:ex777+1iMiMCSIeqX9Ds7+ClJcZ4Tb3Hjn2SwX7Gup3wO2xOwbP6vYWpYpNYlEbj:exr+zgKaDsaicZ43pwiup3nYWeD0EbV

Score

7^/10

upx

Drops startup file 1 IoCs

Processes:

694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PicoPhone.lnk	694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2528-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/2528-1-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/2528-3-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/2528-10-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/2528-16-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\694922c57a6f4ee6beae62cab5c03c4a_JaffaCakes118.exe"
1⤵
- Drops startup file
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:4964

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2528-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2528-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2528-3-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2528-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2528-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download