d7be5afb88232fd4e49a7ef4a3104a4d3fe432aab4e6ee5ff6f911e9463783fc

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 09:01

Target

f56d043c843e1c9cd4695821c632f453_JaffaCakes118.exe
Size

640KB
MD5

f56d043c843e1c9cd4695821c632f453
SHA1

20438a661ddd2dec95c51caa2e0c4473784f9fb9
SHA256

d7be5afb88232fd4e49a7ef4a3104a4d3fe432aab4e6ee5ff6f911e9463783fc
SHA512

a8cce57d1d35db3dad31a8ec3cbb85b1f9876a90f3504d15bb30570f2827859096a9c2301ad00e8105c340b30a02ed72a16281ba5822976342de958f3e2d6be1
SSDEEP

12288:JZPJxdpRg95i3fI5iLuhQvGYco8Xw2QVRNVAtRUUPtxRNvuiByXjXL:jxtRg95ivI5iLu4xRNVORUUPPEXjXL

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1964-0-0x0000000000400000-0x0000000000546000-memory.dmp	upx
behavioral2/memory/1964-4-0x0000000000400000-0x0000000000546000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\datasave.zip	f56d043c843e1c9cd4695821c632f453_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2656	1964	f56d043c843e1c9cd4695821c632f453_JaffaCakes118.exe	86
PID 1964 wrote to memory of 2656	1964	f56d043c843e1c9cd4695821c632f453_JaffaCakes118.exe	86
PID 1964 wrote to memory of 2656	1964	f56d043c843e1c9cd4695821c632f453_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f56d043c843e1c9cd4695821c632f453_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f56d043c843e1c9cd4695821c632f453_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\00.bat
  2⤵
  PID:2656

C:\Users\Admin\AppData\Local\Temp\00.bat

Filesize
252B

MD5
11257d6004e24365c60f5f66c033e6c2

SHA1
8dfb329394afe8d89d5fcfc567d8db17f2910b9a

SHA256
9fa7f54916621debea1a2480fe7961b0339fc1999965f2734eff1b94641e734b

SHA512
8ed61515a7cf0506d214cfc96755995dcd0a99de533f6aee2d49309b28e8cb2de87884046d98968b74d83a73285c05c9499d1d7c770d91cbc3e525d040c77fcd

Download Submit
memory/1964-0-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/1964-1-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/1964-4-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download