1ae7efb121e6171be290820095b9fedcef7a7a99d871eba3dcd856f1b6bd5c16

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe
Size

1.5MB
MD5

f3151cb79fac2ee3243d17b838564766
SHA1

fe43b0487764e95573f60be62c31da3ccceba257
SHA256

1ae7efb121e6171be290820095b9fedcef7a7a99d871eba3dcd856f1b6bd5c16
SHA512

06926e39c227c7a81a525aa4fe4ede2ba21988c5f5317666c1ba4ec00b0bbf5588b3e83a8ba027a51484604516ca58e5780798c38b13615aa1c6879f0bbdd44c
SSDEEP

24576:oNRL/Ygb9CzJkTrTg8L6+OQum2bczfCmO3TrMgnrj/5RW:ovUgbykTrTg8LZOQcmGTrj/j

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3044	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3044	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2012	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c0000000121c5-10.dat	upx
behavioral1/memory/3044-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2012	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2012	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe
3044	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3044	2012	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe	28
PID 2012 wrote to memory of 3044	2012	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe	28
PID 2012 wrote to memory of 3044	2012	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe	28
PID 2012 wrote to memory of 3044	2012	f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe

Filesize
1.5MB

MD5
b3a9f2063c0f7dd1b61a22d52044456e

SHA1
5df465ef2366e2b31556b009ec461c3a2c88cef7

SHA256
b2b1d3373ae852e51a2bdc2aa755b7d87cc54be5595d2a49890f64a296308af0

SHA512
8d519151f67354a621edf070b9a43f5541970a43b22a497884df97341f3797c996c80e3e1d51aac64a7a9e96f8842484aa2a7f7e761d48685f02c2e2e4bd6d59

Download Submit
memory/2012-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2012-1-0x0000000000240000-0x0000000000373000-memory.dmp

Filesize
1.2MB

Download
memory/2012-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2012-31-0x00000000035D0000-0x0000000003ABF000-memory.dmp

Filesize
4.9MB

Download
memory/2012-14-0x00000000035D0000-0x0000000003ABF000-memory.dmp

Filesize
4.9MB

Download
memory/2012-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3044-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3044-17-0x0000000000290000-0x00000000003C3000-memory.dmp

Filesize
1.2MB

Download
memory/3044-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3044-25-0x0000000003520000-0x000000000374A000-memory.dmp

Filesize
2.2MB

Download
memory/3044-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3044-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download