0b9fd18f7f0c5d33e5e79f68e34a1b260bfcac98f723b3248ba41d1cdbde62e3

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 23:37

Target

e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe
Size

2.9MB
MD5

e8b3b77e4a036cbc1f2532358141ca97
SHA1

6fffc2bd616d9ade7d757db99a6f10fbbfbd5714
SHA256

0b9fd18f7f0c5d33e5e79f68e34a1b260bfcac98f723b3248ba41d1cdbde62e3
SHA512

67c95db824c19fd740976ffa317282c8325276063912870e8b369cecb207e777afa8ae0ef412cbcd0589a2587ee9f27e87dd816c6f374c59fbdf82964fe80097
SSDEEP

49152:kxlSUYZke82CyjkO+unOeRDYTPN74NH5HUyNRcUsCVOzetdZJ:alS9ke33kO+EO1P4HBUCczzM3

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2692	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2748	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2748-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000012241-12.dat	upx
behavioral1/memory/2692-15-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2748	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2748	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe
2692	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2692	2748	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe	28
PID 2748 wrote to memory of 2692	2748	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe	28
PID 2748 wrote to memory of 2692	2748	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe	28
PID 2748 wrote to memory of 2692	2748	e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e8b3b77e4a036cbc1f2532358141ca97_JaffaCakes118.exe

Filesize
2.9MB

MD5
f27af0d1222ac476efadf0fc0980612f

SHA1
b41ac0c814ac2b12352910b961223f8ead83dc64

SHA256
28755bb8adaecc2bbfa62984f831926a43c19bfeaa5c6982ddef4f8be77d5f00

SHA512
708195b928521d8c9209d2ee824a01e9995a832acfe7e7a2297e5c9ebf79d0a7ac263e45cce78dc823fb3e152144225fcfb2e58c51c636d61377c9c8f7619822

Download Submit
memory/2692-15-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2692-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2692-16-0x0000000000260000-0x0000000000393000-memory.dmp

Filesize
1.2MB

Download
memory/2692-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2692-23-0x00000000034F0000-0x000000000371A000-memory.dmp

Filesize
2.2MB

Download
memory/2692-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2748-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2748-1-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2748-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2748-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download