1c8c03f94649b51d846cb6f40c979ce586b65830b98dbf92431784846e7a6264

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 19:58

Target

f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe
Size

5.3MB
MD5

f68d57b64cc79ae722adc5809e06461f
SHA1

73debc36392f5a30050fa512f6d41ef67c1a4389
SHA256

1c8c03f94649b51d846cb6f40c979ce586b65830b98dbf92431784846e7a6264
SHA512

36b67f97c97711307a3126ddb588217d02492306efa95060517a030697747b6c3fb592b0f2e0286192c83546034fffd61d6e1691d3010470c448ee459636d41a
SSDEEP

98304:YTaHkbPMh9+o1f/HktBcwQDM2YIDULHJAIQVSIzQJh8HktBcwQDM2YIDULHt:Ya5h9zHschDHIpVTaschDHIN

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
552	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
552	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3104-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral2/memory/552-12-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3104	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3104	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe
552	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 552	3104	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe	86
PID 3104 wrote to memory of 552	3104	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe	86
PID 3104 wrote to memory of 552	3104	f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f68d57b64cc79ae722adc5809e06461f_JaffaCakes118.exe

Filesize
5.3MB

MD5
df3bb142921fb18ebc558261bd78c1a3

SHA1
cade54767bc37700b4e14ff5a97ddf5480c70f0e

SHA256
ad86dad00de996605ee6f5761d32bd8a032c6a0e75c1e76c629c2d0da7c7a6d1

SHA512
69a5900e39c3082145c8cb89bc526a55bb13ac7615951d6d5601ef8370ed7a9b0e84dfee9c171e84d06da936f8cf7eed8b4f5389695745929508b324fa708e0a

Download Submit
memory/552-12-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/552-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/552-15-0x00000000018F0000-0x0000000001A21000-memory.dmp

Filesize
1.2MB

Download
memory/552-20-0x00000000055C0000-0x00000000057E2000-memory.dmp

Filesize
2.1MB

Download
memory/552-21-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/552-40-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/3104-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/3104-1-0x00000000018F0000-0x0000000001A21000-memory.dmp

Filesize
1.2MB

Download
memory/3104-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/3104-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download