1a945360a476dc151f59c5bd4f4518601b1abf1697473c70f02cf8e7011f3a90

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 01:05

Target

c6a2069cb8cfb732f9f87d7cae75a2a6_JaffaCakes118.exe
Size

14KB
MD5

c6a2069cb8cfb732f9f87d7cae75a2a6
SHA1

617bb6ac8f6c11addffe4d226f35edb6ab695336
SHA256

1a945360a476dc151f59c5bd4f4518601b1abf1697473c70f02cf8e7011f3a90
SHA512

95194f8252e9d36df6875811f3b026c2a17d33fb9e0365a401a3da5aed46908bee5132406507a992d58c5433045a28943e3a4f71877e93f243705c0a414e714b
SSDEEP

384:tfI9h5Bx8MlUktE1uE+6vcbV4A2XyyTfGD15GbaGY3+rJg8h:tGhd8hkC1tEbV4NQD18Y36Hh

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3108-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/3108-2-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3108	c6a2069cb8cfb732f9f87d7cae75a2a6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c6a2069cb8cfb732f9f87d7cae75a2a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c6a2069cb8cfb732f9f87d7cae75a2a6_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2224,i,17688331074622862378,73816879873678745,262144 --variations-seed-version /prefetch:8
1⤵
PID:3524

memory/3108-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3108-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download