cd09b7283e85de82ea222017c020850d00bf7c71ee13602c87e26126535d844f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 09:53

Target

f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe
Size

197KB
MD5

f580e62ce3f4579952722bb08d5f1c1b
SHA1

b2d6e3826bb546a2aabd7bfb6624a97edddb7f67
SHA256

cd09b7283e85de82ea222017c020850d00bf7c71ee13602c87e26126535d844f
SHA512

80295fd780b01f9d23b0ac1e2eb01fe1a3ae8bd9695090bc3a3d30ed1c0ddf3d6aea5a8a8d27f4d598282dc2a2687bc6ebf143dcb942a1258a1ce0b23732f0ca
SSDEEP

6144:rjCLhaQJgCCEntpY0Ph6lIXwEvuh2UDNir:hCL80ElIgEmh2Ugr

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3968-0-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3968	f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4424	3968	f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe	90
PID 3968 wrote to memory of 4424	3968	f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe	90
PID 3968 wrote to memory of 4424	3968	f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe	90
PID 3968 wrote to memory of 4424	3968	f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe	90
PID 3968 wrote to memory of 4424	3968	f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe	90
PID 3968 wrote to memory of 4424	3968	f580e62ce3f4579952722bb08d5f1c1b_JaffaCakes118.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1356 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3604

memory/3968-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3968-1-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/3968-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3968-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4424-4-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Filesize
56KB

Download
memory/4424-5-0x0000000000D90000-0x0000000000D99000-memory.dmp

Filesize
36KB

Download
memory/4424-8-0x0000000000D90000-0x0000000000D99000-memory.dmp

Filesize
36KB

Download