9c64869633b22bc8ef197b17564c49c283ee3c6d5f8fd56f7c3b424df765161e

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65ab5c94e2dedaf1f14748d9b9e4882a_JaffaCakes118.exe
Size

256KB
MD5

65ab5c94e2dedaf1f14748d9b9e4882a
SHA1

77da6ff56183330a5f62071e3600f55775cabe93
SHA256

9c64869633b22bc8ef197b17564c49c283ee3c6d5f8fd56f7c3b424df765161e
SHA512

8afef60bee2b58b914840ead4258900e0be153df7c51003d4019a20b556968d61d2bafb379e7390e7ad51cd2c92b2bbd91d179a70e0daa7fd83ee10fa5cb5308
SSDEEP

6144:tO793pVUnTDR1CWnRouAtwi7GeMK7DoWsLWu23UsucYdf72A:a3psRRozCi7GeMK7kW6a7ucYp2A

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3108-0-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3108-1-0x0000000000400000-0x0000000000490000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3108-1-0x0000000000400000-0x0000000000490000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\65ab5c94e2dedaf1f14748d9b9e4882a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65ab5c94e2dedaf1f14748d9b9e4882a_JaffaCakes118.exe"
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3108-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3108-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download