Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 16:28

General

  • Target

    2d060a2d5aaba0b72ae96777fc4f0a32_JaffaCakes118.exe

  • Size

    71KB

  • MD5

    2d060a2d5aaba0b72ae96777fc4f0a32

  • SHA1

    107fa2a725831df76afffd4ef903ea32413f4b63

  • SHA256

    69bd3840b7a2cad6a8739d2f09f6ac1617683300a3ad0b4e0ef400f7e944b666

  • SHA512

    366e41bf378edf7d5050286b48b4db9e15e06cae7c58908dc07f3b2992ca31c64a7e86f82477d9b339e7a8e85958496d342a413a455787601722946a9abbe97d

  • SSDEEP

    1536:3+EHSyWCIpxejMisDu8ITpfwvY6PdxGANHeWVOKX729Su9P9:lHSRIoVS8ITp4vbmANHvVnaTl9

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d060a2d5aaba0b72ae96777fc4f0a32_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2d060a2d5aaba0b72ae96777fc4f0a32_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Adds Run key to start application
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:4220
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,16032378445269040051,10701855434060315937,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
    1⤵
      PID:4480

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\windefender.jpg

            Filesize

            71KB

            MD5

            2d060a2d5aaba0b72ae96777fc4f0a32

            SHA1

            107fa2a725831df76afffd4ef903ea32413f4b63

            SHA256

            69bd3840b7a2cad6a8739d2f09f6ac1617683300a3ad0b4e0ef400f7e944b666

            SHA512

            366e41bf378edf7d5050286b48b4db9e15e06cae7c58908dc07f3b2992ca31c64a7e86f82477d9b339e7a8e85958496d342a413a455787601722946a9abbe97d

          • memory/4220-0-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/4220-9-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB