fec1ecaebe5e195f0a69310df1a10f3a4904646b6be809e662d2b18bd5710f36

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 04:39

Target

f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe
Size

5.1MB
MD5

f05403473a36c781bcc1708aa7f111e2
SHA1

fc2ad93bf389dd112754b6a7a973f91049f6718e
SHA256

fec1ecaebe5e195f0a69310df1a10f3a4904646b6be809e662d2b18bd5710f36
SHA512

df2db71ea4ad2a042d59b6956e7ee760c33834504b5046c83f02305ca959e6695bc87646e5ce963a542cab13eb75aef263daaaa68166dba06cebcad0ab38ff4f
SSDEEP

98304:tbYD0P+W519zcciBb4HBUCczzfFsTRFzV7m94HBUCczz9:JYDoH19Qc9WC4GRFR7mWWCi

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4244	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4244	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2228-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0006000000023279-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2228	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2228	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe
4244	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4244	2228	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe	83
PID 2228 wrote to memory of 4244	2228	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe	83
PID 2228 wrote to memory of 4244	2228	f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\f05403473a36c781bcc1708aa7f111e2_JaffaCakes118.exe

Filesize
5.1MB

MD5
05337343cc5cc98f8eb793bf148fd904

SHA1
58a424e483bea7091f0875f45753f0da3ac424c3

SHA256
385bbb9db9b8199b6d0821268b7bbe08e9836010aa161032bb0d5a3c0a70609e

SHA512
0abed93d31f93ae05ac46b360f073b47ebd74dda4478e49dcb08f5e6a0617ce7fc6ce9d3d53969e7b0e308919ddfbb0abc9361e2d4aa7fcf86da003b33840170

Download Submit
memory/2228-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2228-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2228-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2228-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4244-15-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4244-13-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/4244-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4244-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4244-22-0x00000000056F0000-0x000000000591A000-memory.dmp

Filesize
2.2MB

Download
memory/4244-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download