98753a4170321a94be84e08d95a527c9630491a851d713b584f13c1ad819f0bb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05491811976fe6c793cda65b171bba1d_JaffaCakes118.exe
Size

250KB
MD5

05491811976fe6c793cda65b171bba1d
SHA1

3140def70fe15ae1b84104bace6fe5f70b7f6ef1
SHA256

98753a4170321a94be84e08d95a527c9630491a851d713b584f13c1ad819f0bb
SHA512

25380dccfb96d1d2b13af61af137e85a52e0b4d2050ee76e812205cb0ec7d6787faa912b1c96cccc335412ccfe576da2effe347889ca880f64693cec94475cd9
SSDEEP

6144:HeU57Os9S2oAxQ8q6TzfzcNOa1q6L5Q3Uk2+cax:T73S2ZxS6QOcLQ/2+cax

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2988-0-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2988-1-0x0000000000400000-0x000000000048A000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2988-1-0x0000000000400000-0x000000000048A000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\05491811976fe6c793cda65b171bba1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05491811976fe6c793cda65b171bba1d_JaffaCakes118.exe"
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2988-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download