Analysis

  • max time kernel
    95s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 10:05

General

  • Target

    49514ab71113e8a19f8e46b167d6ba63_JaffaCakes118.exe

  • Size

    185KB

  • MD5

    49514ab71113e8a19f8e46b167d6ba63

  • SHA1

    003a8dac30768f11a6d75ad0f9076ba39216ff4b

  • SHA256

    62b1af10d6ca7a01cd461ec7dfb457a487fbf3a46ee91de3e7a0b6f693a68b9a

  • SHA512

    1d7d9767b2f1c1ce7e461edf0d59e1c0897c5b41bfce860f1cbf7410620586e639c7bc95b6f6f5df267b58dff9f54aeb710ccc4944e25383b6475b8a04f09ba8

  • SSDEEP

    3072:Bdn/22+E8Cz9KuWyuI0opPtBNAWMBoUYo79RpdRTn5Cfcv9yN/ju78n4pekRV1UI:BdugjKuWyuIpzAW45BRpdR9CfcVyN/qf

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49514ab71113e8a19f8e46b167d6ba63_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49514ab71113e8a19f8e46b167d6ba63_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2824

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\whandle.dll

          Filesize

          92B

          MD5

          46f86be30312a6747158f2fd638f372b

          SHA1

          30023f6b0cc632b1952bc8719a95c1db383f1293

          SHA256

          f3c330e708fd2f60be56051662aef1b223708441c3867d8c07e26b14cf5b325e

          SHA512

          72d462f42deae6ae19ebda99aabb56eadf08b8e4d8368a56c5400870fd65e908b591d0ca712b8eb07b4ebff3dc51bbbd00898c9a7a6336f9e168c9358cad77e1

        • memory/2824-0-0x0000000000400000-0x0000000000486000-memory.dmp

          Filesize

          536KB

        • memory/2824-1-0x0000000000920000-0x0000000000921000-memory.dmp

          Filesize

          4KB

        • memory/2824-8-0x0000000000400000-0x0000000000486000-memory.dmp

          Filesize

          536KB

        • memory/2824-13-0x0000000000400000-0x0000000000486000-memory.dmp

          Filesize

          536KB