64c9f12570909a67dd303a2f649ffe65c45333d3121174dbfa43d2d4b3888ccb

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 04:18

Target

e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe
Size

2.5MB
MD5

e934bbcdc92856a2f751f282b0ff56cb
SHA1

9bca880c11c98ea7b11ffa5c660208633cf26bf1
SHA256

64c9f12570909a67dd303a2f649ffe65c45333d3121174dbfa43d2d4b3888ccb
SHA512

9d69cc21fe4c3bb12892393ddeaddb7e3dd6e6a68135ca977f09d69d7148a1164f69ee6685c4725bc9f62224439f701b4274cbe00dec706a9baae820629a4271
SSDEEP

49152:frbnNP2jV1SkzPqpMIl+8qSjv/ON74NH5HUyNRcUsCVOzet0:fPYJDIcKb/O4HBUCczz9

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
3052	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3052	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2200	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012256-12.dat	upx
behavioral1/memory/3052-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2200	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2200	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe
3052	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3052	2200	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe	28
PID 2200 wrote to memory of 3052	2200	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe	28
PID 2200 wrote to memory of 3052	2200	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe	28
PID 2200 wrote to memory of 3052	2200	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Filesize
2.5MB

MD5
37e28a921d5c7119df234e83ed1ed0bc

SHA1
c3730eb4eb6ba0f0c29cb6b0ed10c6e3e1b94c6f

SHA256
1e6e794d8f97c06882d92b21b6b0dc0f3d23b293672eaf41129e90c40f946fb3

SHA512
00efc8df75ddf821b8542c6fe1105ba3427ea00fd38ed416c181a7bb43d8f49d5b818e30bb8b497905782fa8ce050ac5f9f65a0315b68839ae8c8845585d4569

Download Submit
memory/2200-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2200-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2200-4-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2200-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2200-14-0x0000000003730000-0x0000000003C1F000-memory.dmp

Filesize
4.9MB

Download
memory/3052-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3052-18-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/3052-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3052-24-0x0000000003560000-0x000000000378A000-memory.dmp

Filesize
2.2MB

Download
memory/3052-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3052-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download