5bd8ae2b1d9526d98f705ef6d3048675664237859442f6806397d3cb5e063a32

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 22:39

Target

f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe
Size

2.9MB
MD5

f8e7d005861d822877bf68d7909b9a6b
SHA1

5b95f6b3f93ddd607309b80e2e204942761806cc
SHA256

5bd8ae2b1d9526d98f705ef6d3048675664237859442f6806397d3cb5e063a32
SHA512

1538579c231a5ee65a88a67310605fc9b5d989842d8f28ac838c0579087a0b4cc59b71ea4bf20d22224787670a4461c23250427b0f31458c7b798ee8e9db2d91
SSDEEP

49152:vWtWM6DakQz4r09SW1afsbXP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:uH6DahErG18sLgg3gnl/IVUs1jePs

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
3564	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3564	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/760-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000800000002322e-10.dat	upx
behavioral2/memory/3564-14-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
760	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
760	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe
3564	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3564	760	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe	92
PID 760 wrote to memory of 3564	760	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe	92
PID 760 wrote to memory of 3564	760	f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:980

C:\Users\Admin\AppData\Local\Temp\f8e7d005861d822877bf68d7909b9a6b_JaffaCakes118.exe

Filesize
2.9MB

MD5
c71b42e727b4ff097ddf0aedc33d04de

SHA1
977dc1375851d8aa0d00c36b7a41d0d60b3b4a53

SHA256
17c092c7a20d25766938d3d5750212e32330953410e3186dc7dcfd6e5f2120f0

SHA512
4e11720133127d5e4acb8cbda369abe1c5daeb452786955f25bce0b7b82c739cd87506b792ceabb2630d206d60dc512fe3228b3297252273b6efb0378ec51aea

Download Submit
memory/760-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/760-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/760-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/760-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3564-14-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3564-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3564-16-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/3564-21-0x0000000005600000-0x000000000582A000-memory.dmp

Filesize
2.2MB

Download
memory/3564-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3564-41-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download