a95c7e05785540d65f4300d2160c7f098ea1f02927c3681b3a20f8297e7a41ad

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe
Size

2.9MB
MD5

f2fa2b1b8ec36133a536d5ee66bfc09e
SHA1

ff9a5cdbfa3e84c4fb85277d6886c782ce9c9d69
SHA256

a95c7e05785540d65f4300d2160c7f098ea1f02927c3681b3a20f8297e7a41ad
SHA512

031deadf3cf94eb8279ea892588114d6ba5e51656db7676ebcc17f025aeb59b01521b502b7509c08e1220be62454f07bf9542b1003e0f1236def68e685197adc
SSDEEP

49152:7wjPlBUJjsSEW1BtQ5c5SN74NH5HUyNRcUsCVOzetdZJ:QPGQ9WPtf5S4HBUCczzM3

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2844	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2844	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2784	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2784-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b00000001224c-15.dat	upx
behavioral1/memory/2844-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2784	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2784	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe
2844	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2844	2784	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe	28
PID 2784 wrote to memory of 2844	2784	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe	28
PID 2784 wrote to memory of 2844	2784	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe	28
PID 2784 wrote to memory of 2844	2784	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Filesize
2.9MB

MD5
1452db6e2553f48e6ae210fb0786fc04

SHA1
efc940fa07b5fb9d8ae212fb549aadb3934bcd14

SHA256
3086d734d170a4ca41f27d8c991347cdd4f23df4238a5fc9e80044d7f38e31c6

SHA512
cb357bd11963c6cc5b1bbbf961f4e06f5f878cfe15413cc27a8c255fd48978fb595d165427b7426626da2ec1010d8b1eeac9de8492c1f7e50f403b09f7d2d3f9

Download Submit
memory/2784-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2784-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2784-3-0x0000000000270000-0x00000000003A3000-memory.dmp

Filesize
1.2MB

Download
memory/2784-31-0x00000000038E0000-0x0000000003DCF000-memory.dmp

Filesize
4.9MB

Download
memory/2784-14-0x00000000038E0000-0x0000000003DCF000-memory.dmp

Filesize
4.9MB

Download
memory/2784-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2844-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2844-18-0x00000000002C0000-0x00000000003F3000-memory.dmp

Filesize
1.2MB

Download
memory/2844-24-0x0000000003550000-0x000000000377A000-memory.dmp

Filesize
2.2MB

Download
memory/2844-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2844-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2844-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download