Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 16:55

General

  • Target

    ea7744cbbdeac1e00bb2bb7a42f5cb39_JaffaCakes118.exe

  • Size

    43KB

  • MD5

    ea7744cbbdeac1e00bb2bb7a42f5cb39

  • SHA1

    9dd745d489d259d946520ece6987579909593722

  • SHA256

    cf3c52d17194c85db27a21f1fb5b757ba69b9cd78f06d03f83ab754a58478d36

  • SHA512

    40c99a7f86f6048a85d6aed1e4792fca8359dc3f6ef2bfb8debcebd9a2ba5f9866a0e172becce321df30e08fbccfbc1da8f1115b00b1bd39127ee92bd0a9573c

  • SSDEEP

    768:RPSaypiwDe3hLSSaTsbdB4FnYXQIqdQ+y0ShCC5yRga1Cwx9EA9BB7Whq:YayUwDgjfoYAdzy0/CkT1PyA9BB

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea7744cbbdeac1e00bb2bb7a42f5cb39_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ea7744cbbdeac1e00bb2bb7a42f5cb39_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 176
      2⤵
      • Program crash
      PID:1164

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1260-0-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/1260-1-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB