3faac1faf34d3643d4cbd6ba3a02d04840216e8589a1c332fb0e8d728526c48a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 13:45

Target

e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe
Size

56KB
MD5

e79842014bcf82dd28bf24dbf4d77518
SHA1

be395054234bea9e1538fe5cba82cc0bc960a9ef
SHA256

3faac1faf34d3643d4cbd6ba3a02d04840216e8589a1c332fb0e8d728526c48a
SHA512

e0a96b34351c38adf60b9a88efee1ff9fcfa342c39bdfdb85fce877d59d11cf8f1f410a98211fbe2c075573340e084d34fd36aa80054f5c78cb1aba57426e570
SSDEEP

1536:L1QF5SVod6jhI824GrDjCUAWSEl1pINPyBSCdBhbvDV:ZbV86uDf39DlSUdrb

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2372	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2372	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1776	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1776-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x000900000001224c-10.dat	upx
behavioral1/memory/1776-12-0x0000000000160000-0x000000000019A000-memory.dmp	upx
behavioral1/memory/2372-17-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1776	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1776	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe
2372	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2372	1776	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe	31
PID 1776 wrote to memory of 2372	1776	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe	31
PID 1776 wrote to memory of 2372	1776	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe	31
PID 1776 wrote to memory of 2372	1776	e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe	31

\Users\Admin\AppData\Local\Temp\e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe

Filesize
56KB

MD5
dbc66bda4a24ad22e379b868ba764d0a

SHA1
5a6e79e92e17559dad0da4dedfd784b197dbf07c

SHA256
ce3746fd60bc8ebaf20a350f084c64bd69812e2d8142da2cfc59faed6d0e1494

SHA512
e8c4cb4c2020a9606f9c7263c0b3f4d11c6c7a149722192a2e9fa25cf43c076f0b795e4f27d31a21422e9cb23e0fb7a637f2277367d2d651cdcc9f005c604c2d

Download Submit
memory/1776-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1776-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1776-4-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/1776-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1776-12-0x0000000000160000-0x000000000019A000-memory.dmp

Filesize
232KB

Download
memory/2372-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2372-18-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2372-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2372-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2372-29-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/2372-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download