d5dc22cfc862ea915ab9ad26ab1f61638eeb91c63550158f65b2c0ba8c4066b9

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3606df5e7bab58aa0c7ac6351d6427a5_JaffaCakes118.exe
Size

266KB
MD5

3606df5e7bab58aa0c7ac6351d6427a5
SHA1

f572bd2b7eb72d668529c72f8f80deb926baaf68
SHA256

d5dc22cfc862ea915ab9ad26ab1f61638eeb91c63550158f65b2c0ba8c4066b9
SHA512

05b99699a1fe4df5273fb56d8e247314ffb5e832f3535c66e29b745d76ccae77d3c2513cf0bd3d303675ffa824522b213db6aec564e5fec0e620c3a88a770d29
SSDEEP

6144:QlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lM:QHLUMuiv9RgfSjAzRtyM

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral1/memory/3044-1-0x0000000000400000-0x00000000004AF000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/3044-1-0x0000000000400000-0x00000000004AF000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3606df5e7bab58aa0c7ac6351d6427a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3606df5e7bab58aa0c7ac6351d6427a5_JaffaCakes118.exe"
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/3044-1-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download