fec1ecaebe5e195f0a69310df1a10f3a4904646b6be809e662d2b18bd5710f36

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 04:39

Target

f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe
Size

5.1MB
MD5

f05403473a36c781bcc1708aa7f111e2
SHA1

fc2ad93bf389dd112754b6a7a973f91049f6718e
SHA256

fec1ecaebe5e195f0a69310df1a10f3a4904646b6be809e662d2b18bd5710f36
SHA512

df2db71ea4ad2a042d59b6956e7ee760c33834504b5046c83f02305ca959e6695bc87646e5ce963a542cab13eb75aef263daaaa68166dba06cebcad0ab38ff4f
SSDEEP

98304:tbYD0P+W519zcciBb4HBUCczzfFsTRFzV7m94HBUCczz9:JYDoH19Qc9WC4GRFR7mWWCi

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2320	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2320	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2016	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2016-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000e000000012110-10.dat	upx
behavioral1/memory/2320-15-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2016	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2016	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe
2320	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2320	2016	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2320	2016	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2320	2016	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2320	2016	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe	28

\Users\Admin\AppData\Local\Temp\f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Filesize
5.1MB

MD5
0f266ca631b9fef17735d0e9f3098e0e

SHA1
1d5c0ae8ebe211d0e82a0e7ee06b099dd2879baf

SHA256
e7f79b24b30db499f80fb5d9b6677f3c0df7455580ede3660c065ec1304bde28

SHA512
0b7040b6cbcab9a5e9812e72a437e4581a016c90d65ec8483c896ff83aa8e0677573775aef2bc4177d7e2b07d629b05fefa93a66c4f4fdda6bfa26894eb64888

Download Submit
memory/2016-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2016-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2016-3-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2016-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2320-16-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/2320-15-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2320-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2320-23-0x0000000003540000-0x000000000376A000-memory.dmp

Filesize
2.2MB

Download
memory/2320-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2320-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download