0584d853c6428836f404ff11b51bf2741dd481cd7223d7a38ec58ec4ab7b3149

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 23:53

Target

f90839b0f0b11f9c3ac500a6d0bfbaf7_JaffaCakes118.exe
Size

82KB
MD5

f90839b0f0b11f9c3ac500a6d0bfbaf7
SHA1

203cdde494352458658da100364c9fb4997eb082
SHA256

0584d853c6428836f404ff11b51bf2741dd481cd7223d7a38ec58ec4ab7b3149
SHA512

86248ed60d166c0e9200c02255c2d05b18e94ceb08cc81e1d2cf3d8ad248240e3ca2866aed6f2fd07eb0c5add278aa2c74f70f776d887467339a5b4506002429
SSDEEP

1536:UYNAe9+fi4I+3IdXVWbtQ8yAzoHNzm+kV53WpqL9m3ynBVCU:hutId/hpNzm+kV53W/Qn

Score

7^/10

aspackv2

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral2/files/0x000a00000002343c-6.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4504	FOHP5FJF5J4H6

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4504	1444	f90839b0f0b11f9c3ac500a6d0bfbaf7_JaffaCakes118.exe	83
PID 1444 wrote to memory of 4504	1444	f90839b0f0b11f9c3ac500a6d0bfbaf7_JaffaCakes118.exe	83
PID 1444 wrote to memory of 4504	1444	f90839b0f0b11f9c3ac500a6d0bfbaf7_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\f90839b0f0b11f9c3ac500a6d0bfbaf7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f90839b0f0b11f9c3ac500a6d0bfbaf7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\FOHP5FJF5J4H6
  C:\Users\Admin\AppData\Local\Temp\FOHP5FJF5J4H6 "http://powermpeg.com/inwm.data"
  2⤵
  - Executes dropped EXE
  PID:4504

C:\Users\Admin\AppData\Local\Temp\FOHP5FJF5J4H6

Filesize
42KB

MD5
f5f925f802807b1f5f431e2badeccc73

SHA1
bd62ea06a93cf42fee2a67af7638fefe557a1d4b

SHA256
19a10d8b58e9703112347374ddd445abae59ee9e3d7bfa0fe713ac36a52231f0

SHA512
4e21d7bdf749d6abcd25b996ee8318da1ddc0466d1479610cfd4eb90eaaabe3eb01df6738a5de62286a2633f6a61568dbe84f849b0911377d0abd6a59e43fcb8

Download Submit
memory/1444-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1444-15-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4504-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4504-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download