b7fd00a017dc4b7016de9c97356dfbb71d7c979c002778f70c01c3f2c60cf9a5

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 14:49

Target

f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe
Size

2.9MB
MD5

f3b6f509402f25a8f960cb11fea17341
SHA1

ee1c85272aac4e744535b4b1bdce1b07ddc34a82
SHA256

b7fd00a017dc4b7016de9c97356dfbb71d7c979c002778f70c01c3f2c60cf9a5
SHA512

e45de9258f7ed5e32da64283969ab59093b81bf84d9ff1f7de085a0622f78633d8cd4d62efe5c650459e2de807a4978802f62043a6ddbf9c8edc9c31f3348489
SSDEEP

49152:Bylgu+P+ZjSm+Maa1A2w22OcLWSAec1/f5P4M338dB2IBlGuuDVUsdxxjeQZwxP0:BylgB+ZFro22O33z5gg3gnl/IVUs1jek

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1860	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1860	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/824-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0008000000023259-11.dat	upx
behavioral2/memory/1860-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
824	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
824	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe
1860	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1860	824	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe	90
PID 824 wrote to memory of 1860	824	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe	90
PID 824 wrote to memory of 1860	824	f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\f3b6f509402f25a8f960cb11fea17341_JaffaCakes118.exe

Filesize
2.9MB

MD5
36035fc91d4a67f04530db6d9080d6b3

SHA1
386e124bd328d635cd481df440df0385f1d3c471

SHA256
8f81bc4bfdbf12ea6e7d59ab380eff290658d3de7fcbbe5600c30e5c677f0a75

SHA512
e0e368fe8c94f2c2c2cda8969ab094ced71e1f2b268699616cd68aec6f6860f5f1a9ad628e4354ff757455ee655def5946e2cf041e23b9f9f1bfcd259d60a1c6

Download Submit
memory/824-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/824-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/824-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/824-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1860-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1860-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1860-14-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/1860-20-0x0000000005550000-0x000000000577A000-memory.dmp

Filesize
2.2MB

Download
memory/1860-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1860-40-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download