70bdeb644e007d2614a77bb324677b112a87c942f709cfbaf115009a6194fba2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 11:39

Target

eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe
Size

1.3MB
MD5

eafac62ce941b81ceceb80e72b9ef396
SHA1

1329314cf8757035f59911ec33542a8d207d1c1e
SHA256

70bdeb644e007d2614a77bb324677b112a87c942f709cfbaf115009a6194fba2
SHA512

6b6f62b8a5c4b21a8556f912b871e454cffcb5ab7635c893a8084c2034434b0f61527df90192a59772b65da7dfde576f63e207fe5f5af90c0662380c54e948d1
SSDEEP

24576:LysTuCmbCeGlhY9lAZdLQpgeoRePrlwaDRhD3x1dcSFZ1/WhuWc:2sTJ0CeGlhY3+Lhar13BvcSjl/p

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2476	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2476	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2868	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c000000012253-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2868	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2868	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe
2476	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2476	2868	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2476	2868	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2476	2868	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2476	2868	eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe	28

\Users\Admin\AppData\Local\Temp\eafac62ce941b81ceceb80e72b9ef396_JaffaCakes118.exe

Filesize
1.3MB

MD5
7d20d984551d6a64d929ea566eddcffc

SHA1
96c12405a2f1aa07dd9c190fe7000323014df0b8

SHA256
a3f90288ed89452f0957b0ba4803bda436716fe346f3b41907bd9a9c73a9f7ed

SHA512
e37e3e11585c0d8f63970904e6e745693c3a016c0d5b57489c238cdab8c03ded3aa2eb7bd378ce7689bf414e9f34aa6536197b97c4cb197da470cb2b42d1470d

Download Submit
memory/2476-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2476-19-0x0000000000280000-0x00000000003B3000-memory.dmp

Filesize
1.2MB

Download
memory/2476-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2476-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2476-24-0x00000000036A0000-0x00000000038CA000-memory.dmp

Filesize
2.2MB

Download
memory/2476-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2868-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2868-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2868-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2868-14-0x00000000034D0000-0x00000000039BF000-memory.dmp

Filesize
4.9MB

Download
memory/2868-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download