d7bd942ca5060097dad4996ba14bfb69e7b06836a1d386b5c512183c1a315294

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe
Size

1.3MB
MD5

f0d7d51c58bb3a33d3dcfe3432ad9b63
SHA1

4d9fab8498f4f36a57c4a2571d02f9dc21986038
SHA256

d7bd942ca5060097dad4996ba14bfb69e7b06836a1d386b5c512183c1a315294
SHA512

30363234f7cbcd0ed7b00f302ae901ec18fe61059d8252bba475d796dbd682bbe30c188c15dc998f8c264212b3d2824df57fd23618677cd71dd24878dedfeb52
SSDEEP

24576:tak/dLc+HA8VoKL50ebJ0GZoiAJhgLmq+Ldzr6HFECe4rFO3MPKU9/9Us:tnLLg8V3FTjKd/vIb8gR9j

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2836	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2836	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2208	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2208-1-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000d000000012256-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2208	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2208	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe
2836	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2836	2208	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe	28
PID 2208 wrote to memory of 2836	2208	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe	28
PID 2208 wrote to memory of 2836	2208	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe	28
PID 2208 wrote to memory of 2836	2208	f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f0d7d51c58bb3a33d3dcfe3432ad9b63_JaffaCakes118.exe

Filesize
1.3MB

MD5
72edbc31019a4e9cca68cf5a7850858a

SHA1
64f1783a9391fe00040534d2e2fa47be2c24cdf3

SHA256
bce4ec95f7c7faa1d8d54f58a63808f2815db9ee95a0a1d519f4537a90b4fcc6

SHA512
86239c9f95c2fb2fc1dbfda1aafdb8fe1857130f1aabe290a0f9610376c3ae68dada414912f4d439abfda1cdb5c521f4e9887d389caa841026d8114da8a83f67

Download Submit
memory/2208-31-0x00000000034C0000-0x00000000039A7000-memory.dmp

Filesize
4.9MB

Download
memory/2208-0-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2208-3-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/2208-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2208-16-0x00000000034C0000-0x00000000039A7000-memory.dmp

Filesize
4.9MB

Download
memory/2208-1-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2836-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2836-19-0x00000000002B0000-0x00000000003E1000-memory.dmp

Filesize
1.2MB

Download
memory/2836-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2836-25-0x0000000003440000-0x0000000003662000-memory.dmp

Filesize
2.1MB

Download
memory/2836-17-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2836-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download