d7679112ee486274bc6b9a7ddfecaeee2cffd1ed2d69a1dba0445b8f97f7eee4

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 03:35

Target

20f26b7716fce0ec315153bbcf052ff8_JaffaCakes118.exe
Size

431KB
MD5

20f26b7716fce0ec315153bbcf052ff8
SHA1

101168da65c5aee5f748be9ddb5d3b049f10d438
SHA256

d7679112ee486274bc6b9a7ddfecaeee2cffd1ed2d69a1dba0445b8f97f7eee4
SHA512

ed75aa3debe81907fddf1c70ff6f71b20906689bfc3b06369bb757343aa0f0d2e3575c396de5aef6cac8d299c263f15648b029db98025d06665f7ff0da73d2d4
SSDEEP

12288:g4BQAyFZM0iMsBS9dpqhulEgJHS3UWwSnjalT8:UAyLM0i4PcMA33Hjc4

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000400000-0x000000000058F000-memory.dmp	upx
behavioral1/memory/2176-1-0x0000000000400000-0x000000000058F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	20f26b7716fce0ec315153bbcf052ff8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\20f26b7716fce0ec315153bbcf052ff8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20f26b7716fce0ec315153bbcf052ff8_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2176

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2176-0-0x0000000000400000-0x000000000058F000-memory.dmp

Filesize
1.6MB

Download
memory/2176-1-0x0000000000400000-0x000000000058F000-memory.dmp

Filesize
1.6MB

Download