Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 01:39

General

  • Target

    59f2acb79b12243af39c5a6c6979ecdf_JaffaCakes118.exe

  • Size

    60KB

  • MD5

    59f2acb79b12243af39c5a6c6979ecdf

  • SHA1

    4e54024d83de99c4958e6037f1eaa73499e3dcba

  • SHA256

    d0bb3c28854d1a7efa4b70de19099d2241e0dbbd1bc949a17950332fae1c5fb9

  • SHA512

    b20ae8daa57fa5186ca45324ad80e0e26a37665e0ef7705ef02b52730af515c80b1baedc7f17349200738453cdeb9380a9568149d871679fc43bd63d43ee30ad

  • SSDEEP

    1536:xf4exGDkeZ4mOoSgJEAJJvA4yL6j22HpkVkJGjp:p4eYZ4+1JXJJIwTpUVd

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\59f2acb79b12243af39c5a6c6979ecdf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\59f2acb79b12243af39c5a6c6979ecdf_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:1572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsyB127.tmp\InetLoad.dll

    Filesize

    18KB

    MD5

    994669c5737b25c26642c94180e92fa2

    SHA1

    d8a1836914a446b0e06881ce1be8631554adafde

    SHA256

    bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c

    SHA512

    d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

  • \Users\Admin\AppData\Local\Temp\nsyB127.tmp\nsRandom.dll

    Filesize

    21KB

    MD5

    ab467b8dfaa660a0f0e5b26e28af5735

    SHA1

    596abd2c31eaff3479edf2069db1c155b59ce74d

    SHA256

    db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

    SHA512

    7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

  • memory/1572-10-0x0000000000300000-0x0000000000312000-memory.dmp

    Filesize

    72KB

  • memory/1572-19-0x0000000000300000-0x0000000000302000-memory.dmp

    Filesize

    8KB