5443606f6d585d7247fdec8d5da8f135ddb972620317afb165f438bee8fce585

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
Size

275KB
MD5

bdb0ac3ae6972612fe7904201d7b203a
SHA1

c24e76179a10e6eff5f5b8fd7d9f524d439be804
SHA256

5443606f6d585d7247fdec8d5da8f135ddb972620317afb165f438bee8fce585
SHA512

461016259404f5dfc83e693e7cc8df2871e4f666f42aa5f759e53b20b19f6551a221fbd69d037e01c35217832aa1337d6a98be81197d3ad31e92505b3117ef14
SSDEEP

3072:blN9RkkkkkkTLJ0Y6LFWOlN9RkkkkkkTLJ0Y6LFWemqTpxO2wrPKt48j1HdI:5dkkkkkkZ6ZxdkkkkkkZ6ZNVcliu8jDI

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2984-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2984-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x0034000000015c73-6.dat	upx
behavioral1/memory/2984-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2984-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PpGHfk.com	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\DAoC + cdfix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 + cdfix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Silent Hill 4_nocd.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Sims 2_hack.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\DAoC + cdfix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 codes.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Silent Hill 4(trainer).exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4(trainer).exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Doom 3_serial.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\DAoC_cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\DAoC_cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Silent Hill 4 codes.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Counter-Strike cheat.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Doom 3_serial.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2 + cdfix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4_nocd.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Sims 2_hack.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File created	C:\Windows\win32dc\UT2004 fix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\UT2004 fix.exe	bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bdb0ac3ae6972612fe7904201d7b203a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Sims 2_hack.exe

Filesize
278KB

MD5
90dcb2c45da2fc09c8bb131a1289198d

SHA1
49e8d68a0eaba46d1c44aa27e801aa9de02067d9

SHA256
0601627d8f3c1e3ebf240571605307b6b35a3739b30f4eac1f8e91e2b21c0488

SHA512
2f96ba9bb149cea4d3e0aeb674d13b378901a4be990954de492ab80baf6ba872a56fc10a93e1db8a29fcd884df53ed1eee7acd95873aac2d67f8d9fe38d9172c

Download Submit
memory/2984-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2984-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2984-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2984-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads