a95c7e05785540d65f4300d2160c7f098ea1f02927c3681b3a20f8297e7a41ad

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 07:18

Target

f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe
Size

2.9MB
MD5

f2fa2b1b8ec36133a536d5ee66bfc09e
SHA1

ff9a5cdbfa3e84c4fb85277d6886c782ce9c9d69
SHA256

a95c7e05785540d65f4300d2160c7f098ea1f02927c3681b3a20f8297e7a41ad
SHA512

031deadf3cf94eb8279ea892588114d6ba5e51656db7676ebcc17f025aeb59b01521b502b7509c08e1220be62454f07bf9542b1003e0f1236def68e685197adc
SSDEEP

49152:7wjPlBUJjsSEW1BtQ5c5SN74NH5HUyNRcUsCVOzetdZJ:QPGQ9WPtf5S4HBUCczzM3

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
3748	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3748	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1232-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0007000000023402-12.dat	upx
behavioral2/memory/3748-14-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1232	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1232	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe
3748	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 3748	1232	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe	83
PID 1232 wrote to memory of 3748	1232	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe	83
PID 1232 wrote to memory of 3748	1232	f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\f2fa2b1b8ec36133a536d5ee66bfc09e_JaffaCakes118.exe

Filesize
2.9MB

MD5
5403078ac1f87bd8436a79cde85a4ca4

SHA1
9fd8f16c7a59aac7d1420569b10ff1f21ea7d187

SHA256
80b1aeb4686bd1eb6e22e47eebc7d70a3fa570276d6b334951ca9d162c6b94a4

SHA512
50645b691c4edf6b7caafef6ae3b02dfb8aacefed421d736ded973f70c87c3e0a86bf4ec30279ffb11502886f2c8983900d6b923e436951519eee7553eba2558

Download Submit
memory/1232-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1232-1-0x0000000001C60000-0x0000000001D93000-memory.dmp

Filesize
1.2MB

Download
memory/1232-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1232-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3748-14-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3748-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3748-16-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/3748-22-0x0000000005580000-0x00000000057AA000-memory.dmp

Filesize
2.2MB

Download
memory/3748-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3748-29-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download