ca78f7137b9c06521f521472ef2e5640a126338149b3df1ab075de5e15ff16a4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
Size

397KB
MD5

5ce2c083b22abb548b29f1f438c7e2ec
SHA1

22d36070f340e26bbb9930a0f32e955f883bd1cc
SHA256

ca78f7137b9c06521f521472ef2e5640a126338149b3df1ab075de5e15ff16a4
SHA512

f946384d5b40dc3fbd983c20505d2963bbaba0ab90a873d1f269a84d661676d1e4efb08d7dfbe2cc0bc1debd6cafbafb550b954fb93aaf55c558eae26668953e
SSDEEP

12288:5Fd8OoakGungkJn0vBUTQvNshpeIrJRZnDXfJ:HiOUTgkJ0vBg6sCIrJRZnDXfJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2604-0-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral1/memory/2604-37-0x0000000000400000-0x0000000000495000-memory.dmp	upx

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\CurrentVersion\Info	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2604-37-0x0000000000400000-0x0000000000495000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
2604	5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ce2c083b22abb548b29f1f438c7e2ec_JaffaCakes118.exe"
1⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ot

Filesize
85KB

MD5
ee3eace9cb721d938bdf308ce2dd12fb

SHA1
8e74627dc23264c776bea4a8133dba5cfe73c0cb

SHA256
fd05ef0c368183ea8c215a5c5781a19c4682dbd414d72083527dee7959ac88f2

SHA512
f1e35de2d7d2578662da85fe230b9fa3019163d255639fa13c597b48092fe950c362a93ecebc423688c9cb0c1f647f37ca52be4dbc0ef7b1c255b5deca346d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\logo.jpg

Filesize
18KB

MD5
b1588ea7576599084a1f44a235b9f6bb

SHA1
7687a04bf8c718fa451001fce8330fe5e2059419

SHA256
622591ec16cf0e4823ed7ea468ece28b9ea9cf32c87defb8b7059bff27aec32c

SHA512
539e4194999f9d9a212b3c6799910261e9e762fce0e45ecabae0770634ba2e8b1268de6d13911d3fbcc6a4a2738e0f52835fc1053756198c573213ad68d6d8d8

Download Submit
memory/2604-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2604-37-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download