c6ed2fb26e47cb5d303dcd450b19b774195543172940e02a40a47c01143d05af

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 05:13

Target

3c193f2d3da0220d88d2f420d2950a52_JaffaCakes118.exe
Size

415KB
MD5

3c193f2d3da0220d88d2f420d2950a52
SHA1

ec645b093aa483be2173738feecdb18eaae25a62
SHA256

c6ed2fb26e47cb5d303dcd450b19b774195543172940e02a40a47c01143d05af
SHA512

6f8171d6560018ae2d16c7b8b938cefc766d9b481e9ac76b700850c2b4d7c208d184995bfb3b5436a2e9ca0f9266af7a7ebb0e2069fea616192b6d83809a8ea9
SSDEEP

12288:rjkArEN249AyE/rbaMct4bO2/VM8cuqFBEnr:gFE//Tct4bOsqRuqm

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2056-0-0x0000000000400000-0x00000000004D5000-memory.dmp	upx
behavioral1/memory/2056-8-0x0000000000400000-0x00000000004D5000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2056-8-0x0000000000400000-0x00000000004D5000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

C:\Users\Admin\AppData\Local\Temp\3c193f2d3da0220d88d2f420d2950a52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c193f2d3da0220d88d2f420d2950a52_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2056-0-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2056-8-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download