fcdd482e6614fee28d698d46b0f74bcbeff977fb6d64dfc7963eb55deec8571b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 20:49

Target

f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe
Size

1.3MB
MD5

f1e4f0c1b97bdc507eecc29d7915079e
SHA1

5d5fa7aebd027eaa5d8f1e737da9c981d5301f50
SHA256

fcdd482e6614fee28d698d46b0f74bcbeff977fb6d64dfc7963eb55deec8571b
SHA512

e711d8970f38a69daca893a1872e0fced40410993579b571265a56a185f205dad86fb5f02e26ac6f066b5bb3fe227678089faf267b3b49875ed247f375470129
SSDEEP

24576:7jvaotK7b9ztTsEmLvppCdY3eXMLcIhgdzTvG:3vHtmsEmTedX8L

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2864	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2864	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2860	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000b0000000139e0-15.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2860	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2860	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe
2864	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2864	2860	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2864	2860	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2864	2860	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2864	2860	f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f1e4f0c1b97bdc507eecc29d7915079e_JaffaCakes118.exe

Filesize
1.3MB

MD5
1d716b538ae935ed61dc5d26d4da30cb

SHA1
86a5055056d58f9b314e67d221a64eb2bbae9588

SHA256
7906df77cb65c228f5361bad52abbe7ea36150ed7896996655d47bba4e61186a

SHA512
63ef17c950fde13efc41145ee8dee72c83517e9df9d4f546e99befa2c70ad4b6f53ee4f3b9cfbe32452e764c177256c2976fece8f1be57f899748c9418f78ffd

Download Submit
memory/2860-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2860-2-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/2860-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2860-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2860-16-0x00000000035A0000-0x0000000003A0A000-memory.dmp

Filesize
4.4MB

Download
memory/2860-26-0x00000000035A0000-0x0000000003A0A000-memory.dmp

Filesize
4.4MB

Download
memory/2864-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2864-19-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2864-21-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2864-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download