Analysis

  • max time kernel
    140s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 07:49

General

  • Target

    5b0bbfb06bcceff60cc07ac6ebcb1ec5_JaffaCakes118.exe

  • Size

    342KB

  • MD5

    5b0bbfb06bcceff60cc07ac6ebcb1ec5

  • SHA1

    5d05cb1a4249393de101f41b57be6ba05eaa8c3f

  • SHA256

    8a369f07f54c6209f48fb13028b0d9639f7024b75bba1d256dcb23e6e27aa505

  • SHA512

    8d78fcdb7039db95ef39d38163d0fc8908673ea72df1765e1819a4d9f2020f436378d76fc6690f1efa292335222cb82f07be1610a53df3457218ff77c380d892

  • SSDEEP

    6144:ElZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lLIHBU0t8ST:EHLUMuiv9RgfSjAzRtyV0tl

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3408
      • C:\Users\Admin\AppData\Local\Temp\5b0bbfb06bcceff60cc07ac6ebcb1ec5_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\5b0bbfb06bcceff60cc07ac6ebcb1ec5_JaffaCakes118.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:900
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          C:\Users\Admin\AppData\Local\Temp/server.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3044

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\server.exe

      Filesize

      63KB

      MD5

      5b6d8bab1a985efc291db70337a71203

      SHA1

      dd7b6d9980c6337b1f6279fefeda5658950ccb17

      SHA256

      4b23d1d95f83b98421889bf5d8831c33dad09853000168c4308d2b03b0c6ed07

      SHA512

      d2521d1a1179431d9b6e8095a7463952d7204b70325827a94c09196f8389a7fd3f0571c976e2be6fe12b6b1bf98ffadee1cc5b80fa7d4103c87e192da020f682

    • memory/900-0-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/900-11-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/3044-8-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3044-12-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/3044-20-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3044-19-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/3408-13-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

      Filesize

      4KB

    • memory/3408-15-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

      Filesize

      24KB