Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 12:20

General

  • Target

    49c116a8c426d124ecd7683afad2e790_JaffaCakes118.exe

  • Size

    720KB

  • MD5

    49c116a8c426d124ecd7683afad2e790

  • SHA1

    30ba69accf8d5511454d45331c91a277a201eae0

  • SHA256

    a088affcb7aa7a6ce8e511fb575998b4ccbadadcbc13138fa6db8e8ceedd2672

  • SHA512

    09d07e630af2bc30c57a8f498c5d4f7f6ada202317d42e6e2d55728d3da5b5b1c6713c18f95ace4860d55155ec6506459e36457673d3f9f0e03456b159cd3323

  • SSDEEP

    12288:KFHp50yo/d3TxMzcM7J7roIrPAFfA5EpOuhsIGm1QbCsv73fmwNxs0GhAHyTvN5G:Y5AJxYfJ4I7A500vh1GiMJvqwvFAASDW

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies Control Panel 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49c116a8c426d124ecd7683afad2e790_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49c116a8c426d124ecd7683afad2e790_JaffaCakes118.exe"
    1⤵
    • Modifies Control Panel
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1524-0-0x0000000000400000-0x00000000005E5000-memory.dmp

    Filesize

    1.9MB

  • memory/1524-1-0x0000000000900000-0x0000000000901000-memory.dmp

    Filesize

    4KB

  • memory/1524-2-0x0000000000400000-0x00000000005E5000-memory.dmp

    Filesize

    1.9MB

  • memory/1524-4-0x0000000000900000-0x0000000000901000-memory.dmp

    Filesize

    4KB