a54ee3ebd986ee77e42cf80eee2cfbabb37751d6cb9d555d4d02564d866a8483

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe
Size

2.7MB
MD5

e828f14da66c98d0e83fb6bddcf35724
SHA1

c0544a6d1d00e349c54911e978a55eb9637ce032
SHA256

a54ee3ebd986ee77e42cf80eee2cfbabb37751d6cb9d555d4d02564d866a8483
SHA512

8e34b215a5f58d4f4eb31b1b630a2435887e480d736d248be85fc59b03065b156c70bca2d2d9a3941be1973ee4ed5810da32e5daebf9763d82bb2f5674ae480d
SSDEEP

49152:ebSFBZXw7aUtCv5GM8i+/jbAstvn0yrhrmHA2VzcvfeqXrcMEdf:LJweUtCv5GM2oYn0yhmgU+myEdf

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2704	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2704	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2020-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c0000000133c1-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2020	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2020	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe
2704	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2704	2020	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe	28
PID 2020 wrote to memory of 2704	2020	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe	28
PID 2020 wrote to memory of 2704	2020	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe	28
PID 2020 wrote to memory of 2704	2020	e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e828f14da66c98d0e83fb6bddcf35724_JaffaCakes118.exe

Filesize
2.7MB

MD5
9d8c85a38658b1e6bc4e82dbabfc1d3e

SHA1
d0699df2094042fbc0e4b0643c8d8c5a781a5b7b

SHA256
81b0b3db360e38614183331c8e33fd914a311f350a4a99cc79ea1fc193c9ab64

SHA512
2a607fd6bedd4a1ec389035953add9fbfaab09e907d53ead6c262ac36e4b87cf12deafac8b6fca16c73d48d6dfb25686a7743068f62bb3f8ba1e1730a2707457

Download Submit
memory/2020-31-0x0000000003770000-0x0000000003C5F000-memory.dmp

Filesize
4.9MB

Download
memory/2020-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2020-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2020-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2020-15-0x0000000003770000-0x0000000003C5F000-memory.dmp

Filesize
4.9MB

Download
memory/2020-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2704-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2704-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2704-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2704-24-0x0000000003550000-0x000000000377A000-memory.dmp

Filesize
2.2MB

Download
memory/2704-19-0x00000000002C0000-0x00000000003F3000-memory.dmp

Filesize
1.2MB

Download
memory/2704-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download