3bc578b6e317204b29ec12fe10137fd7117df2b93fcf754c761e4d3bbbd35f7e

Analysis

max time kernel
141s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44dc535b27f0817405c819639e50fb21_JaffaCakes118.exe
Size

357KB
MD5

44dc535b27f0817405c819639e50fb21
SHA1

b9673ac4809367c4f9c224f41c41c6f4e2c17a29
SHA256

3bc578b6e317204b29ec12fe10137fd7117df2b93fcf754c761e4d3bbbd35f7e
SHA512

ec93659787a1a9e8cc7070bd39ea5f978c5ed7479557d800610f1955b15aced5696731a2713f87d3351f818ecb33a836b309394f87109df08bdd33c7da76f3e5
SSDEEP

6144:g8yZw0EMTNHw7Ip+rKUEqpjyfe03qJf1zw4T/+8zXTfwcDKl+oSUG:pZ0btw6+rK5qkfe03j4j+cD4choSr

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4792-0-0x0000000000400000-0x000000000050A000-memory.dmp	upx
behavioral2/memory/4792-12-0x0000000000400000-0x000000000050A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4792	44dc535b27f0817405c819639e50fb21_JaffaCakes118.exe
4792	44dc535b27f0817405c819639e50fb21_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\44dc535b27f0817405c819639e50fb21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44dc535b27f0817405c819639e50fb21_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\44dc535b27f0817405c819639e50fb21_JaffaCakes118.data

Filesize
1KB

MD5
c864f0b6895638792b2dee4faffaccad

SHA1
1ab321c1949068eb7931b5b9a2728a82dbe1986c

SHA256
4c009b3abc40ed1fd05e1a72911d04958fbe73ab2364e957c7d97415a8e54e7d

SHA512
428919e10e5e1beaf5ed46ef4d0cac17d6fe997c095c6310caf88300300dad89b765fa1f5dcb40af2a7721a8ba98e4a2d01ace633e65d00499238ea18a8c52a5

Download Submit
memory/4792-0-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/4792-12-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download