ef8e5b522b9e5ce79650f54a3fe307d978b290d8d19921ec74b12f6a8998605f

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38562e09ae943cdb13d350d183d93649_JaffaCakes118.exe
Size

3.1MB
MD5

38562e09ae943cdb13d350d183d93649
SHA1

bbc4d07d8e029999c4c2c86954eae83e2a388526
SHA256

ef8e5b522b9e5ce79650f54a3fe307d978b290d8d19921ec74b12f6a8998605f
SHA512

5f88329d9980b4ad19bddce3ba45d0b25466318f91d66f0ee3ed33e35b4eb1f4a972afb05918679f3d873e80d351dc339a7b88f0408b5bacadb6755388ef3a97
SSDEEP

98304:sI1kLDRRBTwbnMUMXVw+nl2capREDWrvyqUigtS:I9wQV723xv7IS

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1680	38562e09ae943cdb13d350d183d93649_JaffaCakes118.exe
1680	38562e09ae943cdb13d350d183d93649_JaffaCakes118.exe
1680	38562e09ae943cdb13d350d183d93649_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1680-70-0x0000000000400000-0x0000000000468000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\38562e09ae943cdb13d350d183d93649_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38562e09ae943cdb13d350d183d93649_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Temp\1JQ2PR7B\38562e09ae943cdb13d350d183d93649_JaffaCakes118\plugins\0\CustomUI.dll

Filesize
344KB

MD5
04eecd03af7eafb84b6581a5b37d275e

SHA1
3351059d04a2e9f9f0a3719083eeda03dab0f124

SHA256
39ba967edebb288f921c37348d7c21b05e3af40033e0eb386f35b4be2b04be50

SHA512
19088141aa48e1bb74202d09751006fa9182568750caa7e3132169c66c9fee4a784cb1139c954b1c940f9578cfa51be7474c09780cc6fda3022e69eeec9c21d9

Download Submit
\Temp\1JQ2PR7B\38562e09ae943cdb13d350d183d93649_JaffaCakes118\plugins\1\Services.dll

Filesize
105KB

MD5
3ab4759b51da484ead6abf916f853c9b

SHA1
a91d59a8b8e81ae4dc66b39e7b991735c2790d77

SHA256
3b7672d1f8b9bcdebacf98e0bc2a29f2bd430211101b297f1f5ad712de7ee62b

SHA512
7205a5e84c191419dfde07b8f4aebe42f9ec4d231de20bce4ce04d9cf61c30f43904db4f401faeb4b166b8c9f3ba06f379eab6601219bf996326fb7f6a6a8cf1

Download Submit
\Temp\1JQ2PR7B\unpack.dll

Filesize
34KB

MD5
705aa1dc6f5fb72a2182ffd2c95bfa2e

SHA1
08de4589e01d3f0f589209baf8b669fae04b5875

SHA256
ec8361e43f0f83d0da13261718b8791e5517375fce67b4055d390353a5b2ca00

SHA512
5d00edf396efc5c130e1e7071fe027afaaa35d4d746441a1f0e0736c4828941e55e49f5319f5c1739bd75d2b5e03504d59284b2754430e0053e3f8d5f2702e4d

Download Submit
memory/1680-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1680-1-0x0000000000240000-0x00000000002A8000-memory.dmp

Filesize
416KB

Download
memory/1680-64-0x0000000002D30000-0x0000000002D8C000-memory.dmp

Filesize
368KB

Download
memory/1680-67-0x0000000003390000-0x00000000033AF000-memory.dmp

Filesize
124KB

Download
memory/1680-70-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1680-72-0x0000000003390000-0x00000000033AF000-memory.dmp

Filesize
124KB

Download
memory/1680-71-0x0000000002D30000-0x0000000002D8C000-memory.dmp

Filesize
368KB

Download
memory/1680-90-0x0000000003390000-0x00000000033AF000-memory.dmp

Filesize
124KB

Download
memory/1680-89-0x0000000002D30000-0x0000000002D8C000-memory.dmp

Filesize
368KB

Download