dbe7461db7ee827a14de0969f0c5aec2ded41f58fe1a828cad7cd6b2f8623093

Analysis

max time kernel
152s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d4c0281fdee14345c193408a41e34e4_JaffaCakes118.exe
Size

35KB
MD5

0d4c0281fdee14345c193408a41e34e4
SHA1

f768ae874ef10c76e51658864e4a7d66da93c98b
SHA256

dbe7461db7ee827a14de0969f0c5aec2ded41f58fe1a828cad7cd6b2f8623093
SHA512

b677428070f86429b54725cdee29f0bb60bc5c5216986a4684a6a47ef0f09956396e4cf487c4048c59fe928a7f21a19026e6b76da14a52e2fd539a876b3df611
SSDEEP

192:loMfGdl63lwre7a1qWnopQlCqtxp7t/j:loMOdl6KCYqWopQlbhlj

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4436-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-1-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-2-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-3-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-4-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-13-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-14-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4436-15-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

C:\Users\Admin\AppData\Local\Temp\0d4c0281fdee14345c193408a41e34e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d4c0281fdee14345c193408a41e34e4_JaffaCakes118.exe"
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4436-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4436-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4436-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4436-3-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4436-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4436-13-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4436-14-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4436-15-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download