ac930bd06b65b403396f3fade120ef6d4fe22b6a407ae8cf742fa3ca380023ff

Analysis

max time kernel
139s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 16:35

Target

f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe
Size

2.9MB
MD5

f85c48f901a45c22c9b0d3ddee563c4d
SHA1

d7e6d4bff630b733ba8f03e43a1704cc9cb8671b
SHA256

ac930bd06b65b403396f3fade120ef6d4fe22b6a407ae8cf742fa3ca380023ff
SHA512

d2216df971bab0a508d1d6322bfb06212ab73d7332bf25105831f9bff1a99cc986bb3342e391cf4225b4e1fe97e51d91c5786953970f170844d1817ed93b451e
SSDEEP

49152:fWA8w4yn3jLs03HLBt6/3M00N74NH5HUyNRcUsCVOzetdZJ:+A8wDzYULGUP4HBUCczzM3

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2880	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2880	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/448-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x00070000000233ed-11.dat	upx
behavioral2/memory/2880-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
448	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
448	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe
2880	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 2880	448	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe	90
PID 448 wrote to memory of 2880	448	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe	90
PID 448 wrote to memory of 2880	448	f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\f85c48f901a45c22c9b0d3ddee563c4d_JaffaCakes118.exe

Filesize
2.9MB

MD5
7d005d24b78cca2ed9432771dacca9fa

SHA1
99ede36f7c401abb60a162a72f518098e4d17230

SHA256
5636a1c4d6412159013262ee538402f4d05e1b94f431f0a8910fa695d7131d92

SHA512
c95426d264665ad7d28b4a7eeeedc31c02e89e89367b2b47f6d6636353f8346580282a8bd37e83a2c69d578aadb2fb363e71eb751653c90b42cf8df272512136

Download Submit
memory/448-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/448-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/448-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/448-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2880-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2880-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2880-14-0x0000000001C50000-0x0000000001D83000-memory.dmp

Filesize
1.2MB

Download
memory/2880-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2880-22-0x0000000005550000-0x000000000577A000-memory.dmp

Filesize
2.2MB

Download
memory/2880-40-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download