Analysis

  • max time kernel
    9s
  • max time network
    10s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-04-2024 01:10

General

  • Target

    ab9582ddfa864cb74274996be3da4607_JaffaCakes118.exe

  • Size

    34KB

  • MD5

    ab9582ddfa864cb74274996be3da4607

  • SHA1

    f2647c550898918cb6ea8949899b58fb7a765906

  • SHA256

    6e272d0a88884509597620e94e036e24f99a2f5c635216f4a9ba4749ce12be9b

  • SHA512

    c0907340126cd2f67a3e623ce5038a6d8b3b2ee263d420bec097a608638937909695eace84debdb2940dd2f7298fbb7961389fe1ca2591e891e7775611aabb36

  • SSDEEP

    768:Sp22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:SpYoX58z1uirL98xMWnT0OQ9J2

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\ab9582ddfa864cb74274996be3da4607_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ab9582ddfa864cb74274996be3da4607_JaffaCakes118.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4320

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2612-16-0x00000000000C0000-0x00000000000C6000-memory.dmp

      Filesize

      24KB

    • memory/3512-8-0x00007FF828560000-0x00007FF828561000-memory.dmp

      Filesize

      4KB

    • memory/3512-18-0x0000000002080000-0x0000000002086000-memory.dmp

      Filesize

      24KB

    • memory/3512-4-0x00000000006F0000-0x00000000006F6000-memory.dmp

      Filesize

      24KB

    • memory/3512-7-0x00007FF8283CD000-0x00007FF8283CE000-memory.dmp

      Filesize

      4KB

    • memory/3512-11-0x00007FF828540000-0x00007FF828541000-memory.dmp

      Filesize

      4KB

    • memory/3512-3-0x00000000006F0000-0x00000000006F6000-memory.dmp

      Filesize

      24KB

    • memory/3720-20-0x0000000000690000-0x0000000000696000-memory.dmp

      Filesize

      24KB

    • memory/4216-9-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/4216-0-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/4216-10-0x00000000021B0000-0x0000000002BB0000-memory.dmp

      Filesize

      10.0MB

    • memory/4216-2-0x00000000021B0000-0x0000000002BB0000-memory.dmp

      Filesize

      10.0MB

    • memory/4216-1-0x0000000000570000-0x0000000000571000-memory.dmp

      Filesize

      4KB

    • memory/4320-5-0x00000000011B0000-0x00000000011B6000-memory.dmp

      Filesize

      24KB

    • memory/4320-6-0x0000000077B02000-0x0000000077B03000-memory.dmp

      Filesize

      4KB