95e61476e62f52adf956032cf38fb84a5a028e7ed9904f2c837afee40f2a81b3

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 04:18

Target

eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe
Size

1.3MB
MD5

eca6a382f9e26bf5c60d007a6f767318
SHA1

6fd89bc23f66ff856f7ad7e05d68953af0ba11d4
SHA256

95e61476e62f52adf956032cf38fb84a5a028e7ed9904f2c837afee40f2a81b3
SHA512

74bb85f4a0a7b9fafee5ee1f421aad5433a03a9bb6e1cb8515e0a6eedbb2545257ce6effb72e261fcce56635c5c80926b4ae7beaaa5c76e1c696e9fadaef8cc2
SSDEEP

24576:E0GZ9HlCMxm75IhoHF5ocAcDftlN45EXsmaWU2YFfI6VF1RoXYWc:E0GZHCltIhoHF5ZD3KQTaWv61RXp

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2852	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2852	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3044-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000700000002321d-11.dat	upx
behavioral2/memory/2852-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3044	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3044	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe
2852	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2852	3044	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe	83
PID 3044 wrote to memory of 2852	3044	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe	83
PID 3044 wrote to memory of 2852	3044	eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\eca6a382f9e26bf5c60d007a6f767318_JaffaCakes118.exe

Filesize
1.3MB

MD5
9d515dc9bec4fd913d67cf16b91fbe88

SHA1
e7ac6739ead22acdd846d6b3559bb7b319f5a035

SHA256
2212c849de9c2946633a6256d5320f111a0233ee5faeda90cf8bd8d0913bd6ec

SHA512
9e1fc85bff656d2bb69d7123b99812cecf08986387a78ac451313d5d2ec0daa185c4a36d0f5ab28a5ee6f8aad1283ea37b963dc03247d1a8afb10373eaf50243

Download Submit
memory/2852-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2852-14-0x0000000001C50000-0x0000000001D83000-memory.dmp

Filesize
1.2MB

Download
memory/2852-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2852-20-0x0000000005550000-0x000000000577A000-memory.dmp

Filesize
2.2MB

Download
memory/2852-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2852-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3044-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3044-1-0x0000000001DE0000-0x0000000001F13000-memory.dmp

Filesize
1.2MB

Download
memory/3044-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3044-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download