e09ef1fb2633c4636f0058ee5983dc3cd2db6501a51bb1ac519422592f7b0be9

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
Size

146KB
MD5

d96f4976c5c1d8f17c489c31f0b9714e
SHA1

d229628ac0ad3d5d922b975e8e45c3c089cf815f
SHA256

e09ef1fb2633c4636f0058ee5983dc3cd2db6501a51bb1ac519422592f7b0be9
SHA512

8ff025ac6445a8a9af227944012e543175dc717d923dabc60fab9aed4378f6a86533ee15fbafe0c570a9c461fe3c1398203ea3d58cc1294dc5eb900442f3a3c6
SSDEEP

3072:blN9RkkkkkkTLbYSxmx1q1lsPwTIaKhsBaA6:5dkkkkkkb4x1C6wTIaW2Z6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3164-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3164-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x000700000002321b-6.dat	upx
behavioral2/memory/3164-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3164-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Yp.com	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\BattleField 1942(trainer).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 hack.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2 hack.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4(cheat).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Quake3 crack.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\Quake3 + hack.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2(nocd).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2(nocd).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\DAoC_patch.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\Silent Hill 4(cheat).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\BattleField 1942(serial).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\Quake3 crack.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\Quake3 + hack.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\DAoC_patch.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942(serial).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\BattleField 1942(trainer).exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\Sims 2 + crack.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
File created	C:\Windows\win32dc\Half-Life 2_cheat.exe	d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d96f4976c5c1d8f17c489c31f0b9714e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Quake3 crack.exe

Filesize
150KB

MD5
76e2ef370910867d0d3b9a1bdd0387ba

SHA1
5baa101cf9f1d154205c74983a7af5f3accbb0f6

SHA256
595a0b9e68b5a89133a428375b3b5d7f5c2fb77a451e58190e1aadaf61eea81c

SHA512
364f700135d2e859c088d507ae20b6f582e56ffd86c3698ccaa76fb8afa1f9dac43852e13eb02ee22dbb490f1a0718de65e06ae00f6faafe8107653aa254c970

Download Submit
memory/3164-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3164-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3164-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3164-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads