bf7d74f7d8da08e6c841856dcf431ee9db35c49b07d9f3e7b5ef27a8f0a93395

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
Size

2.9MB
MD5

ed6cd2dc1e7fa8ca1402b624a10617e7
SHA1

70aa40a6ad2ff6b4acb5d9b13485e59fe0930ced
SHA256

bf7d74f7d8da08e6c841856dcf431ee9db35c49b07d9f3e7b5ef27a8f0a93395
SHA512

4bda8922a4dd563ede2e3be6a4a12c717874b758d9afd8056b50feb7c81ae9914beb39552511d9dfaf02aad0c8d925580d1b06b9751a541a6c6e659d6a2c68ba
SSDEEP

49152:haLkv/bZT/efrBJvXjKtzh14UhuRD5TP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:hYkv1WTBJvmlhWgg3gnl/IVUs1jePs

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2616	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2616	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2300	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2300-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c00000001224e-12.dat	upx
behavioral1/memory/2616-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2300	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2300	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
2616	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2616	2300	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe	28
PID 2300 wrote to memory of 2616	2300	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe	28
PID 2300 wrote to memory of 2616	2300	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe	28
PID 2300 wrote to memory of 2616	2300	ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe

Filesize
2.9MB

MD5
9d443da1f175db3778089bc7bfe507ca

SHA1
a47b7cce0e10a3a915d7680a16dcfb98c344ae85

SHA256
9c9f3a66a356331a459fa6784eac84b557853e6bf21e0781fb102de5caa3633a

SHA512
92fb9873219ac2c74fc50d5357bc9ab99dbe40485967ac6f2ca194e7b0fd10fa28f618455647adc7c9762fa1180f19826f41df5fe86ca453923809a6f1c3beb6

Download Submit
memory/2300-15-0x0000000003AC0000-0x0000000003FAF000-memory.dmp

Filesize
4.9MB

Download
memory/2300-3-0x00000000002C0000-0x00000000003F3000-memory.dmp

Filesize
1.2MB

Download
memory/2300-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2300-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2300-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2300-31-0x0000000003AC0000-0x0000000003FAF000-memory.dmp

Filesize
4.9MB

Download
memory/2616-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2616-17-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2616-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2616-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2616-25-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/2616-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download