028602255076b5aef0ba52708c66421d04f2fd3df221ccbe84c38ed35977fa40

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 02:36

Target

f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe
Size

1.3MB
MD5

f27d27c9d664b4e0843b59a58168bcdd
SHA1

c6d58c38684f59906e1a5b7ef25e65d68ea20088
SHA256

028602255076b5aef0ba52708c66421d04f2fd3df221ccbe84c38ed35977fa40
SHA512

021eb566ebc40d8d61c06ba4ece34267bdf2d37c8c94de883b53b4d1f9e94cb315aa868db4a60475cb8bba51dce4d74fd537469e235419545023bd324b96af64
SSDEEP

24576:sSIJtghE7YPF47f5HV1RTvOaVFKAHLkjawDF5JVP0vG:PIJShE72Fsh11FvlVxwN

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2516	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2516	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2188	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x0008000000012253-11.dat	upx
behavioral1/memory/2188-16-0x00000000034F0000-0x000000000395A000-memory.dmp	upx
behavioral1/memory/2516-18-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2188	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2188	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe
2516	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2516	2188	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe	28
PID 2188 wrote to memory of 2516	2188	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe	28
PID 2188 wrote to memory of 2516	2188	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe	28
PID 2188 wrote to memory of 2516	2188	f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe	28

\Users\Admin\AppData\Local\Temp\f27d27c9d664b4e0843b59a58168bcdd_JaffaCakes118.exe

Filesize
1.3MB

MD5
d3758012677dd82e0a66d1d72fcd568a

SHA1
1848e1d4ecac354e627c6256384c622b0fddb35c

SHA256
478b31fb793177716f5a2d3103cdae82ed85d3c6a4298d90ee4053d43835050e

SHA512
e3679c0becb283bf3da15542b2f6501969e5af9719879ec37a386ad5d8ed288883253b13b7351e79c3dee7e75ac0d3c819b690c9674e8604e205fe760718c450

Download Submit
memory/2188-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2188-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2188-2-0x0000000000260000-0x0000000000372000-memory.dmp

Filesize
1.1MB

Download
memory/2188-16-0x00000000034F0000-0x000000000395A000-memory.dmp

Filesize
4.4MB

Download
memory/2188-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2188-26-0x00000000034F0000-0x000000000395A000-memory.dmp

Filesize
4.4MB

Download
memory/2516-18-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2516-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2516-20-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2516-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download