3437c43183aa87ac59294373af447fd4467675495bc8ff298c07c302e3b2f44c

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe
Size

357KB
MD5

386a01b038a6bb7cf34a7970e6609653
SHA1

f2db6eb4637951dce4885256d902198769f02cd1
SHA256

3437c43183aa87ac59294373af447fd4467675495bc8ff298c07c302e3b2f44c
SHA512

21e588ed823ff4b17703bf95f05a495d45808a114d07193590c9b8811b6e530cb7a65b10d7c3f3435d85a9dd65248b66d8345c0c0d44b43303f275ffcf29f153
SSDEEP

6144:p8yZw0EMTNHw7Ip+rKUEqpjyfe03qJf1zw4T/+8zXTfwcDKl+oSUx:GZ0btw6+rK5qkfe03j4j+cD4choS4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1748-0-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral1/memory/1748-11-0x0000000000400000-0x000000000050A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1748	386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe
1748	386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.data

Filesize
1KB

MD5
329793ad730a353c53f342fb7d1dc9bc

SHA1
727a5e6ffaed00ec8ab0743779e4f03cbed139c6

SHA256
7fc846617b0513828d63cc6edf12ac6e4df8948f4ea27df2d2b499b07105ef7f

SHA512
d7362870745fdbec32bb8c507438d536fe3fc7d2585557c2941301d7dbde59621d236c745d681b7e7879d3b362663e690255c2019e011fe6a975a5a2abba8d4d

Download Submit
memory/1748-0-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/1748-11-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download