fa964284c00c634ff36f2558908145fd349f4c0da517a66b047da3dc73d7c3d4

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 10:33

Target

f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe
Size

1.3MB
MD5

f0d9fcc0823f182c4780599f9172613e
SHA1

5ad305c5ec69af7f3fa5dd64e3f727976231facd
SHA256

fa964284c00c634ff36f2558908145fd349f4c0da517a66b047da3dc73d7c3d4
SHA512

251ddb7fbaf4a46ac83c6c7ee05e1a38df6e831cd55b71aa8e431ea00e62a45935cb7145018189a231a0c8d21735002741444f32f9477fe2bb6fba712b2ec9ff
SSDEEP

24576:ry3yk5juDRkLKIMsPUTqWrCQkch3kc8RDtCYQ6i2Ze6j9QlTyOSvG:G30DmeRsiAUkc81EYQ6p1jCs

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2700	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2700	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1708	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x00070000000120e4-11.dat	upx
behavioral1/memory/2700-17-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1708	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1708	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe
2700	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2700	1708	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2700	1708	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2700	1708	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2700	1708	f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe	28

\Users\Admin\AppData\Local\Temp\f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe

Filesize
1.3MB

MD5
5f7e392fcc3cc042514e6f64d3515b18

SHA1
b2462c41972144b927b5e14627271c9074f5a17c

SHA256
f31d60ddd6b9bb1b56e5f5548c010ba732f3c4f54d2492de891b3a7e777f6639

SHA512
da930ca2accf059cfaa5fc26f2a5e681042fdd72701e8b6736486938e697b3df2bb590a7bdce64f0d75ae0f42331666bc3bc0ecb4b630ed61d4c6a07831ca511

Download Submit
memory/1708-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1708-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1708-7-0x00000000002B0000-0x00000000003C2000-memory.dmp

Filesize
1.1MB

Download
memory/1708-15-0x00000000033D0000-0x000000000383A000-memory.dmp

Filesize
4.4MB

Download
memory/1708-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1708-26-0x00000000033D0000-0x000000000383A000-memory.dmp

Filesize
4.4MB

Download
memory/2700-17-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2700-18-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2700-19-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2700-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download