a9accd4c4da095f72f84613d3f62c6226d8e9f47e122fc7ad396a95ac75ee26c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 21:31

Target

e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe
Size

1.5MB
MD5

e8765215c3bfd5c37a31efc507ee98d3
SHA1

92fbf264aee4b964e8881b141a5200b020ad9016
SHA256

a9accd4c4da095f72f84613d3f62c6226d8e9f47e122fc7ad396a95ac75ee26c
SHA512

bfe85c8e452dfe55d1472bbd2f36b54e26f9b5fb4d5e40f41f0257c6c7d1fb9982362eb6da334d946e2926d866df666fd562f88adadf35a667efbc5b3f53defa
SSDEEP

24576:9DMQsE2qgD4XrCs/5XxpU88DyPybEBbv+HtguhF3aAwwAfzX/EW:S1E9En0XxO88yxxuhF3xmr8

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4052	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4052	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/464-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x00090000000224f7-11.dat	upx
behavioral2/memory/4052-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
464	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
464	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe
4052	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4052	464	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe	86
PID 464 wrote to memory of 4052	464	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe	86
PID 464 wrote to memory of 4052	464	e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\e8765215c3bfd5c37a31efc507ee98d3_JaffaCakes118.exe

Filesize
1.5MB

MD5
22929bb36938c4eaa9337958c3df8fc2

SHA1
1620a17de626010b7b2f869b0867779cbfa33918

SHA256
a40d739da7c518e2a4b2e5fdecb186c1e98d2ed690235d8a66ee24d57aff2946

SHA512
6e5317231a20674b375dc8f34395b41d4eefbd2e7b08fa9dc98cb86de2dddd813872b27f810fda9b1f2c52ecf0201081d09a8f5db031fbf2d77a6792990ea024

Download Submit
memory/464-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/464-1-0x0000000001D00000-0x0000000001E33000-memory.dmp

Filesize
1.2MB

Download
memory/464-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/464-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4052-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4052-15-0x0000000001CA0000-0x0000000001DD3000-memory.dmp

Filesize
1.2MB

Download
memory/4052-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4052-21-0x00000000055A0000-0x00000000057CA000-memory.dmp

Filesize
2.2MB

Download
memory/4052-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4052-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download