93913596742bd8928e1a9a5e4f6e75e070155b3629827fbd43605702ca1e9261

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
Size

221KB
MD5

3e0dfd74f87f1c3cacb3d52f9ec34e1e
SHA1

34193ae88a3852c8ecbdd6851c4e14b8c4c9df9b
SHA256

93913596742bd8928e1a9a5e4f6e75e070155b3629827fbd43605702ca1e9261
SHA512

2206ae7504531c273b1e4bbaf35a7c9b7a4f4871d273a2605b3353b390dcd54d931b65a6e32867c9ae9934cc2492e2d60c64ffb1c4ad9fede97d6b1ba1594e28
SSDEEP

6144:6f4xe+SJVrL/PL6x8DCH+JigkjBIltvuPSHzC6ynOhTX1In:6Oe+43/2xIJJigk2vvuPAqCTW

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2296	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1292-0-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral1/memory/1292-12-0x0000000000400000-0x000000000046F000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lncom_	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lncom.exe	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1292	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2296	1292	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe	31
PID 1292 wrote to memory of 2296	1292	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe	31
PID 1292 wrote to memory of 2296	1292	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe	31
PID 1292 wrote to memory of 2296	1292	3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\3E0DFD~1.EXE.bat
  2⤵
  - Deletes itself
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3E0DFD~1.EXE.bat

Filesize
133B

MD5
5943ad25f10950cb01b53fa1099ae9eb

SHA1
c772826ebae5c65c1238ea73b8a7bf8d62d5d5b0

SHA256
5e26f7bdefb98cbde72ffa4f144101b14b81ddefd5c90cde2922a2c619fe93a5

SHA512
852c6d9878baece2429c3cc3f58359ff8b89d5b3f6ee367a16c1ff6ec11b23d6e2791671db59eab6d958197aa38afc653d1be2548b0bc4d26870a05c62ad2d4f

Download Submit
memory/1292-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1292-12-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download