Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 18:55

General

  • Target

    1c217490c976b09c4983a717bc9d8700_JaffaCakes118.exe

  • Size

    187KB

  • MD5

    1c217490c976b09c4983a717bc9d8700

  • SHA1

    e4e982224bb04b4af02f229e4d157c5b0c8ff640

  • SHA256

    1441d5854bc29be1c0642f545e202c407a33c9f801247b305b3858645b38b0e8

  • SHA512

    89eccc447f354354dad6598944c0ed1e24db5f95c4dfc8cb8727468ec3d0683f6aeee091dc9dcdb515f04c15ddad540ad73d4f112ee4a3d95272412866d74f1c

  • SSDEEP

    3072:zP2zZJa3CpKtdUbfr75SL0DnsOvwHDNTI95/v5LMM:zP2zZnidYfr7ogwJHDJi59

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 2 IoCs
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c217490c976b09c4983a717bc9d8700_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1c217490c976b09c4983a717bc9d8700_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Drops autorun.inf file
    PID:1352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • F:\1c217490c976b09c4983a717bc9d8700_JaffaCakes118.exe

    Filesize

    187KB

    MD5

    1c217490c976b09c4983a717bc9d8700

    SHA1

    e4e982224bb04b4af02f229e4d157c5b0c8ff640

    SHA256

    1441d5854bc29be1c0642f545e202c407a33c9f801247b305b3858645b38b0e8

    SHA512

    89eccc447f354354dad6598944c0ed1e24db5f95c4dfc8cb8727468ec3d0683f6aeee091dc9dcdb515f04c15ddad540ad73d4f112ee4a3d95272412866d74f1c

  • memory/1352-0-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1352-6-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1352-7-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1352-8-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1352-14-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1352-15-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1352-16-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB