e7535f23afbfb71725a4fed8ef89253b4627deec09076d4e82edf262d4bea713

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 09:50

Target

29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe
Size

63KB
MD5

29e65fade92e2c7a6297fde13528d838
SHA1

36571d978f4fa32418f0797a486f65a1c1bf3720
SHA256

e7535f23afbfb71725a4fed8ef89253b4627deec09076d4e82edf262d4bea713
SHA512

ee15923927854f8c6497fa300d2679843ab71ce6df437b4ca52b371cfe0624ff094d1526c4f64a36c04b15884e78e9151473f0d968fd6a447a7f437d34d5a4dc
SSDEEP

768:UtMJ21h7OCKq5Ka4z+C2kp9L/rIAKbHVaJOzuqrdqzd92TzGSL6vM1hMqrG5mihT:aT7nX5Ka4zS8lzI16so92T/sB5mih

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2824	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2304-1-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2304-4-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2304	29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2824	2304	29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe	31
PID 2304 wrote to memory of 2824	2304	29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe	31
PID 2304 wrote to memory of 2824	2304	29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe	31
PID 2304 wrote to memory of 2824	2304	29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29e65fade92e2c7a6297fde13528d838_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ctj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2824

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Ctj..bat

Filesize
238B

MD5
7f49752b17091f67ff3f518fa4eb1f1b

SHA1
3d0df23473fbb408cd88ad268743218331315dad

SHA256
be89839364d476a226bc1078d79463287be5dc22fde668097ec3d684152d6b32

SHA512
e59db070a6bc7767c5b7448c64ece339ec9bc2fb154d1f06eaa591289cc7d0c8d043173364859c448e7b2ddc2c51f35d9639bd1fc810e469e4001b6f67693ab4

Download Submit
memory/2304-0-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/2304-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2304-4-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download