1ea5493dd9ef2f121d01facb98bd882850f14d74d5d645f700476cf7221b2b00

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91f098de95017af7699b088b7242699c_JaffaCakes118.exe
Size 615KB
Sample240603-qmw8kshc24
SHA256 1ea5493dd9ef2f121d01facb98bd882850f14d74d5d645f700476cf7221b2b00
MD5 91f098de95017af7699b088b7242699c
SHA1 a34922e637b23e591865b2a2c287c305af7b8ec1
SHA512 4c1686e544621918e4aec93851210fc64dca7abde4699ec439a240332d964a686db72bdd1d6c56e3fb037529fdab1fd1618f6d5e6f2b90a9f0013eaa2de90e54
SSDEEP 12288:MhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNIwN:ERmJkcoQricOIQxiZY1WNIwN
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3200-0-0x0000000000400000-0x00000000004AF000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\91f098de95017af7699b088b7242699c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91f098de95017af7699b088b7242699c_JaffaCakes118.exe"
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Download