fcf8541ebdefb917b9b20db5a46ccc2150fc2313a38a10650e1449527c2ecb34

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ea8893c604386f7a0146098ef75d747_JaffaCakes118.exe
Size

28KB
MD5

3ea8893c604386f7a0146098ef75d747
SHA1

bc5d80e6f7b76f84b9a7d2d27f2c45dc9b297c7e
SHA256

fcf8541ebdefb917b9b20db5a46ccc2150fc2313a38a10650e1449527c2ecb34
SHA512

092dafb5244b8d5dde15c55f0b3731f9ff899bc62c8cb05e5f94fcfd605e5890c456ef2f4c89eed5837393cc9b41fdd9fa3df022795e72d53ba7b6a5953de0c8
SSDEEP

768:uBQuvdXSJDPBz9+wglKpw3pXAOIih+b3Oy4i6k/ROfIa:uWwxSRPBz4BKK1AOeb3b/R6Ia

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1976-3-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2700	1976	3ea8893c604386f7a0146098ef75d747_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2700	1976	3ea8893c604386f7a0146098ef75d747_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2700	1976	3ea8893c604386f7a0146098ef75d747_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2700	1976	3ea8893c604386f7a0146098ef75d747_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3ea8893c604386f7a0146098ef75d747_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ea8893c604386f7a0146098ef75d747_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
238B

MD5
1f547fa2672008b8583aa5931ab0a6e9

SHA1
1a40ca236d6712c3a63436ce48ef59a5f2777803

SHA256
856b258c5aabaf1636ee77dfcb01e5e244178b5d9b9b8e582382295fa7054248

SHA512
c28a51dc100f5b0434958276d047d32589a07f2c2aa45499be321b72bfe4bbf90244cf023c0346ee46fd97820707670d0c14ce1a60335975f4e8b07ce53e2f1e

Download Submit
memory/1976-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1976-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1976-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download