0337c74cb88fd5e43131b64f8edaf795ce60ff6204efccaec96570325b51f6bc

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe
Size

5.8MB
MD5

e7d5522647e1e459e8953bcc7473e35f
SHA1

9ec7b54eab816391ec3a8b3c0b1554cd2a4a2bc5
SHA256

0337c74cb88fd5e43131b64f8edaf795ce60ff6204efccaec96570325b51f6bc
SHA512

219f797d611ee1395831043d9f09efe932a8572d98bc2729cf950130280c0d3bb0523c7056e095f6d7b3f2bb6f4f1a3e6d027774417de2c2db1b61a204e96146
SSDEEP

98304:FmJiO5LPEq1zotjHau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwk6:fE1s5auq1jI86FA7y2auq1jI86

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1996	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1996	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2332	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000015e9f-12.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2332	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2332	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe
1996	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1996	2332	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe	28
PID 2332 wrote to memory of 1996	2332	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe	28
PID 2332 wrote to memory of 1996	2332	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe	28
PID 2332 wrote to memory of 1996	2332	e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e7d5522647e1e459e8953bcc7473e35f_JaffaCakes118.exe

Filesize
5.8MB

MD5
9e6a3dbc0c57548c94b315edbe8e8abb

SHA1
1a210aaa20dc2675c0c81b34eb49bb5a0c89d340

SHA256
3ab9ebeb006af5b00c28484157ce923f90dd653803ba64f550907d627bdf3265

SHA512
daf0e00263112b60a8852f22e16189d77dde90542196b969d44b499bd8a1e99af45c13074fe6d78249c0ecf2e79980dd921c3b39738e906e4c5e5fb624915441

Download Submit
memory/1996-20-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1996-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1996-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1996-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/1996-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1996-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2332-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2332-1-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2332-16-0x0000000003DD0000-0x00000000042BF000-memory.dmp

Filesize
4.9MB

Download
memory/2332-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2332-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2332-31-0x0000000003DD0000-0x00000000042BF000-memory.dmp

Filesize
4.9MB

Download