4674c8f7f10851b1abce7c24b48c1f334a992f09d7b28fe529ea84c4e7470d3a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe
Size

359KB
MD5

42e800f562b0598039593c5365ff9e26
SHA1

a2976516a6fc76125c3e3894014d36eede8f1c00
SHA256

4674c8f7f10851b1abce7c24b48c1f334a992f09d7b28fe529ea84c4e7470d3a
SHA512

a350bb6c43ef0b33f93fa3a4fc466761f6aa785d49fda760578d2749fca9c48a22bdbfb5bbd63324c0330d845bf0b9298f53f2271c7ba12575f7d64868f6f9bf
SSDEEP

6144:X/vOM65ERltmlY424i31rZzd6ifcDjgftcWz808aBqpLlEoS4a:XHOrChB5/6ifusz8kqpSoS1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3640-0-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral2/memory/3640-18-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral2/memory/3640-37-0x0000000000400000-0x000000000050E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3640	42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe
3640	42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe
3640	42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe
3640	42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe
3640	42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe
3640	42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\42e800f562b0598039593c5365ff9e26_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\42e800f562b0598039593c5365ff9e26_JaffaCakes118.data

Filesize
854B

MD5
d607d446ff50c1188d6f96188ab53318

SHA1
db3d6090c0cfa3337407a1661a68568a1a77436b

SHA256
a1feb26ad016c39f8a3a8144a52f1a7c2875bd99c58c9315b509bf5996c32a3e

SHA512
287c509fe575c0fb21895e99317075efb63f779faed5eb58a83ee601badb5a1840fa6cb29b4052d902dccabc235de39d63af92b938dc20d5e81dc00f747b5082

Download Submit
memory/3640-0-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/3640-18-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/3640-37-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download