Analysis

  • max time kernel
    140s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2024 20:08

General

  • Target

    3698f41f4bec80a7f2602dc937588762_JaffaCakes118.exe

  • Size

    131KB

  • MD5

    3698f41f4bec80a7f2602dc937588762

  • SHA1

    0b80550b41713e25133cd1b3f301bc50215c2cf1

  • SHA256

    0812978799036721eb8789146d0b2b60b6704264b85c70c95bfe15a78f5c9cda

  • SHA512

    69cf45ef89b5fc875db9b5666270f8691cad36824acf9f0a5746a619e41d5b100ff7b7f3219b938432b85e206e7315857917a9557cfdbae836444a53cd5b4076

  • SSDEEP

    3072:6A3qlID7wgUHd4RlgQcVQe6+AezL2URrtzhcz8wE5/3:6A3rPU94RlgH/66OYVhmEx

Score
5/10

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3698f41f4bec80a7f2602dc937588762_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3698f41f4bec80a7f2602dc937588762_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\3698f41f4bec80a7f2602dc937588762_JaffaCakes118.exe
      ?
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1644-0-0x0000000000403000-0x0000000000405000-memory.dmp

    Filesize

    8KB

  • memory/1644-2-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/3032-7-0x0000000010000000-0x000000001000F000-memory.dmp

    Filesize

    60KB

  • memory/3032-9-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/3032-8-0x0000000010000000-0x000000001000F000-memory.dmp

    Filesize

    60KB

  • memory/3032-4-0x0000000010000000-0x000000001000F000-memory.dmp

    Filesize

    60KB

  • memory/3032-3-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB