a9accd4c4da095f72f84613d3f62c6226d8e9f47e122fc7ad396a95ac75ee26c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe
Size

1.5MB
MD5

e8765215c3bfd5c37a31efc507ee98d3
SHA1

92fbf264aee4b964e8881b141a5200b020ad9016
SHA256

a9accd4c4da095f72f84613d3f62c6226d8e9f47e122fc7ad396a95ac75ee26c
SHA512

bfe85c8e452dfe55d1472bbd2f36b54e26f9b5fb4d5e40f41f0257c6c7d1fb9982362eb6da334d946e2926d866df666fd562f88adadf35a667efbc5b3f53defa
SSDEEP

24576:9DMQsE2qgD4XrCs/5XxpU88DyPybEBbv+HtguhF3aAwwAfzX/EW:S1E9En0XxO88yxxuhF3xmr8

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2136	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2136	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3000	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3000-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c00000001233c-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3000	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3000	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe
2136	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2136	3000	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe	28
PID 3000 wrote to memory of 2136	3000	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe	28
PID 3000 wrote to memory of 2136	3000	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe	28
PID 3000 wrote to memory of 2136	3000	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Filesize
1.5MB

MD5
104c0497ef18c2bc7e48863f0f8511fc

SHA1
ba820d8b8e74abdcb18301be1366f6a74f4a0e28

SHA256
fac87dc6304a514e4f32a11edd3cf4203b4c8faccca8b5e6030c5113b7223291

SHA512
77e16eebdc937bac2cb6cb53f85d12818fd42ff528bc4b6d2e66e3ed826548873774789e078c363bf5b4b2f15fd0a815a91ece27d23403cdf717ca159c9efecd

Download Submit
memory/2136-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2136-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2136-21-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2136-24-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2136-27-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2136-33-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3000-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3000-1-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/3000-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3000-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3000-15-0x0000000003510000-0x00000000039FF000-memory.dmp

Filesize
4.9MB

Download
memory/3000-32-0x0000000003510000-0x00000000039FF000-memory.dmp

Filesize
4.9MB

Download