230b770f0feca21560a1d41fe77db21e22a7ddd342f1ca21c463c7b80532cfc9

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe
Size

646KB
MD5

7fabec7a705fb382dcc88c739a80a8ed
SHA1

1d56be68144c4dc56b610e9165228f0d4428402d
SHA256

230b770f0feca21560a1d41fe77db21e22a7ddd342f1ca21c463c7b80532cfc9
SHA512

1ce42fe74997d4cb917ddbc89c238a24f287cae874e70ef2407b11f08d271edcd7fa1ec3b20ce1cd3b24f038e674d527535539620eef146aadb6512a53def091
SSDEEP

12288:8xPX6yka6qpGoiWJKecENF6E+6YmU8IC7Gi3oG+PMheayYgayNP7ZuATSKHA:89X6yksplltN8ErYmgNzjPMsLYgayB1M

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000015d20-11.dat	acprotect

Loads dropped DLL 5 IoCs

pid	Process
2376	7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe
2376	7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe
2376	7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe
2376	7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe
2376	7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000015d20-11.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7fabec7a705fb382dcc88c739a80a8ed_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso1B02.tmp\GetVersion.dll

Filesize
6KB

MD5
dc9562578490df8bc464071f125bfc19

SHA1
56301a36ae4e3f92883f89f86b5d04da1e52770d

SHA256
0351fe33a6eb13417437c1baaee248442fb1ecc2c65940c9996bcda574677c3f

SHA512
9242f8e8ece707874ef61680cbfcba7fc810ec3a03d2cb2e803da59cc9c82badd71be0e76275574bc0c44cdfcef9b6db4e917ca8eb5391c5ae4b37e226b0c321

Download Submit
\Users\Admin\AppData\Local\Temp\nso1B02.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
memory/2376-20-0x0000000075010000-0x0000000075019000-memory.dmp

Filesize
36KB

Download
memory/2376-19-0x0000000075000000-0x0000000075009000-memory.dmp

Filesize
36KB

Download
memory/2376-18-0x0000000075010000-0x0000000075019000-memory.dmp

Filesize
36KB

Download
memory/2376-25-0x0000000075010000-0x0000000075019000-memory.dmp

Filesize
36KB

Download
memory/2376-26-0x0000000075000000-0x0000000075009000-memory.dmp

Filesize
36KB

Download
memory/2376-27-0x0000000075010000-0x0000000075019000-memory.dmp

Filesize
36KB

Download