64c9f12570909a67dd303a2f649ffe65c45333d3121174dbfa43d2d4b3888ccb

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 04:18

Target

e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe
Size

2.5MB
MD5

e934bbcdc92856a2f751f282b0ff56cb
SHA1

9bca880c11c98ea7b11ffa5c660208633cf26bf1
SHA256

64c9f12570909a67dd303a2f649ffe65c45333d3121174dbfa43d2d4b3888ccb
SHA512

9d69cc21fe4c3bb12892393ddeaddb7e3dd6e6a68135ca977f09d69d7148a1164f69ee6685c4725bc9f62224439f701b4274cbe00dec706a9baae820629a4271
SSDEEP

49152:frbnNP2jV1SkzPqpMIl+8qSjv/ON74NH5HUyNRcUsCVOzet0:fPYJDIcKb/O4HBUCczz9

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2208	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2208	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3588-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000800000002325a-11.dat	upx
behavioral2/memory/2208-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3588	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3588	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe
2208	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2208	3588	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe	94
PID 3588 wrote to memory of 2208	3588	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe	94
PID 3588 wrote to memory of 2208	3588	e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\e934bbcdc92856a2f751f282b0ff56cb_JaffaCakes118.exe

Filesize
2.5MB

MD5
207e78e52a9fbe4f745e47987167a7e6

SHA1
3bb49a299164b1faccce29e0d32dfc98be0fa351

SHA256
e30571fb051723dca660f83bc489fc4af16a96830102690b7a0008f8fc8fe8e3

SHA512
023410ab9b1960b6ce199b4cbf3cc9e4f8cafe91b72aa3d895bb191f1a65b5842db8e15e772fb79a60843a71ff9f73454e27e684484f960efc7042ad1504388d

Download Submit
memory/2208-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2208-14-0x0000000001C50000-0x0000000001D83000-memory.dmp

Filesize
1.2MB

Download
memory/2208-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2208-20-0x0000000005550000-0x000000000577A000-memory.dmp

Filesize
2.2MB

Download
memory/2208-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2208-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3588-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3588-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/3588-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3588-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download