12db789012b013720fb523de590b37530133bac18585d4698053cab2626b3b63

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 17:14

Target

e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe
Size

2.9MB
MD5

e7fdf1e6b5fe272443b305fdde093e9c
SHA1

84d9bab571c7ecba8343eeb2e4957928624df9a4
SHA256

12db789012b013720fb523de590b37530133bac18585d4698053cab2626b3b63
SHA512

10ecfbafa8df7d9f01f9e77f6e369cbc195c302285dcb1560f6d271daecf743ed1ed2730c5511256d2ac9a4bc1068a06a6f1ac8b77a7268b0217a32d376d8d88
SSDEEP

49152:habTEzobVArJO/LYQND+UUWVN74NH5HUyNRcUsCVOzetdZJ:habx0O6YV4HBUCczzM3

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2000	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2000	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2864	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2864-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000012251-10.dat	upx
behavioral1/memory/2000-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2864	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2864	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe
2000	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2000	2864	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe	28
PID 2864 wrote to memory of 2000	2864	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe	28
PID 2864 wrote to memory of 2000	2864	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe	28
PID 2864 wrote to memory of 2000	2864	e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe	28

\Users\Admin\AppData\Local\Temp\e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe

Filesize
2.9MB

MD5
58a41c94bd4aab00c01bc3344d36b524

SHA1
548690bde8ab486061e5d84dfde06336ed097fe5

SHA256
c53fe94b87cca24159a2c6845435e6b256557faf4d821f0365de244eae4afe21

SHA512
127bcafd7c6826deee1c6a1d2ffb4250f75ff8308eceadb2c2e75d04b4144a2afd1fcf1c632dc7c2972d67b97b592acb7b3706e6e3ac864fb049bfaadb4d0b77

Download Submit
memory/2000-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2000-18-0x0000000000290000-0x00000000003C3000-memory.dmp

Filesize
1.2MB

Download
memory/2000-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2000-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2000-25-0x0000000003520000-0x000000000374A000-memory.dmp

Filesize
2.2MB

Download
memory/2000-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2864-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2864-4-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2864-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2864-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2864-13-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download