Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 22:27
General
- Target a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118.exe
- Size 165KB
- Sample240612-2db2tswhnk
- SHA256 05b3347fcddf440da243f5fc417202d7eb2ac56f66c69f77d8385a33be55c595
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 13 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
extra.dll
inetc.dll
nsJSON.dll
sign.dll
memory/2736-46-0x00000000744B0000-0x00000000744C8000-memory.dmp
memory/2736-16-0x00000000746B0000-0x00000000746C7000-memory.dmp
memory/2736-35-0x00000000746B0000-0x00000000746C8000-memory.dmp
memory/2736-47-0x00000000744B0000-0x00000000744C8000-memory.dmp
memory/2736-14-0x00000000746B0000-0x00000000746C8000-memory.dmp
memory/2736-41-0x00000000744B0000-0x00000000744C8000-memory.dmp
memory/2736-37-0x00000000746C0000-0x00000000746CA000-memory.dmp
memory/2736-36-0x00000000746B0000-0x00000000746C7000-memory.dmp
memory/2736-57-0x00000000744B0000-0x00000000744C8000-memory.dmp
memory/2736-56-0x00000000744B0000-0x00000000744C8000-memory.dmp
memory/2736-15-0x00000000746B0000-0x00000000746C8000-memory.dmp
memory/2736-77-0x00000000746B0000-0x00000000746B8000-memory.dmp