7d69c62ff911fcba7aa839d8dcfeaa218842041464f8e30bb587a0b29e4c58bc

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:29

Target

f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe
Size

2.9MB
MD5

f5e25481eb4464ef608e529921a81e3c
SHA1

c8588bcc38aed6392a627b0a9924f0458ace060b
SHA256

7d69c62ff911fcba7aa839d8dcfeaa218842041464f8e30bb587a0b29e4c58bc
SHA512

b49e42376c54c9fc172bdb9c117e4297057099f4f55a38e709b433c428403ff96e086bdc3865237015ee9f373fd0a2d4d9dca1ef313822a3986e9586bfe69d27
SSDEEP

49152:8bVpQgzoLIPMr9sxsQCzx5QOP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:8bnZIIPMpsxsLzxbgg3gnl/IVUs1jePs

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2484	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2484	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/944-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x00070000000233be-11.dat	upx
behavioral2/memory/2484-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
944	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
944	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe
2484	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 2484	944	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe	85
PID 944 wrote to memory of 2484	944	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe	85
PID 944 wrote to memory of 2484	944	f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f5e25481eb4464ef608e529921a81e3c_JaffaCakes118.exe

Filesize
2.9MB

MD5
6598f4d014ee2d00b0fcde9499fbcebd

SHA1
861ee826189f4096a32797d987446f15224ebb35

SHA256
be7c95ebf8a6df42dfe561eca54189f55c31eb58d7c239e7df6ea053aea7e8dd

SHA512
552a07e7736f062c985ff9cee66389ad095fd9f05197db963985452dde42276a0998f37ea6b320f046f3dc9cf9b0b89b4663701050febf2da8d2ef917dfd2dbd

Download Submit
memory/944-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/944-1-0x0000000001C70000-0x0000000001DA3000-memory.dmp

Filesize
1.2MB

Download
memory/944-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/944-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2484-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2484-14-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2484-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2484-21-0x00000000055C0000-0x00000000057EA000-memory.dmp

Filesize
2.2MB

Download
memory/2484-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2484-40-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download