12816c47fbd852cc9dd835ee8710bbb6f6b939a2da9cca53ef21f377ccb3226d

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 21:14

Target

e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe
Size

1.3MB
MD5

e86e583447adc55332c0df458dc3b6cb
SHA1

26057c87b5783f2f447251bcf2833fb3a1b1b3b4
SHA256

12816c47fbd852cc9dd835ee8710bbb6f6b939a2da9cca53ef21f377ccb3226d
SHA512

9a0e621a5796a6ee2d32ff247eefef76fa3cab14c9b09ff2416d83ff1bd2796d1c96325231e266feeab24fca9efaed71eb507b339e6c6a2ed7825ce932c92ed3
SSDEEP

24576:sTltBe8oXf0iuf2Pn4b+BbTpJqluneIR7qjIwVdqzWc:gwRBuW4qhpJqInXR7BwCp

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4524	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4524	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5036-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000c000000022f7b-11.dat	upx
behavioral2/memory/4524-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5036	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5036	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe
4524	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4524	5036	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe	95
PID 5036 wrote to memory of 4524	5036	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe	95
PID 5036 wrote to memory of 4524	5036	e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe	95

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\e86e583447adc55332c0df458dc3b6cb_JaffaCakes118.exe

Filesize
1.3MB

MD5
935fd506b1196a31fa07194674a8f3b2

SHA1
e9a7cdb202e2187071ef80dfb5f0ae71bfce3558

SHA256
1c0ce41a032fd0a262022c6b901c8d3ed34ddf9e893b5cbb7ecb0f1529623ac6

SHA512
bef0659297a52043a86303548d517d32dfcf6e8011cd88645ae3da4ee594041ae3ee835eb1d6a340a31899f04ef794fb6a9fa966bca4c38993ee906fbe7bfe11

Download Submit
memory/4524-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4524-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/4524-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4524-20-0x0000000005620000-0x000000000584A000-memory.dmp

Filesize
2.2MB

Download
memory/4524-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4524-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/5036-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/5036-1-0x0000000001BF0000-0x0000000001D23000-memory.dmp

Filesize
1.2MB

Download
memory/5036-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/5036-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download