52505d688dc53e8ca5a3441df8f60d9c2c77b15a78d75faa011e8a3c2f78411c

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 19:38

Target

f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe
Size

2.9MB
MD5

f8a05581af77b10c5572d22f8ad9abc8
SHA1

33734bd46cb0cfa6d1e4e79ecd840297e966e009
SHA256

52505d688dc53e8ca5a3441df8f60d9c2c77b15a78d75faa011e8a3c2f78411c
SHA512

b4550545917a95536897f6a094e1c9104dd523ff8db3c42b2aceb975ea6e5622f1f3b25df792b3991162baae93dbecf3dead4552a2495b8aa9e53b772ba27c02
SSDEEP

49152:Rz0QR9VZnVmzpGBtL+4Sm+bwVIQ11N74NH5HUyNRcUsCVOzetdZJ:SQRpVipGDL+u+sl4HBUCczzM3

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4720	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4720	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5004-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000800000002323c-11.dat	upx
behavioral2/memory/4720-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5004	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5004	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe
4720	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4720	5004	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe	90
PID 5004 wrote to memory of 4720	5004	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe	90
PID 5004 wrote to memory of 4720	5004	f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=940 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4024

C:\Users\Admin\AppData\Local\Temp\f8a05581af77b10c5572d22f8ad9abc8_JaffaCakes118.exe

Filesize
2.9MB

MD5
4810a534f47d36c164083861f4a18235

SHA1
c5508b9c4530d1ef879009e1be1990c300ea5399

SHA256
d9063bceb54ca695c8371a98da2d8e8fce500392f76ea2b078e04fdcee4a8a69

SHA512
2ef3aee0520471689ca83c9ec0f9094da0ae29e9703aa7eea4e478dac58265441b92d811a87981268feecbd1825206cfce87c75b2981d42cca0c1ca1386a87c1

Download Submit
memory/4720-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4720-15-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/4720-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4720-20-0x0000000005590000-0x00000000057BA000-memory.dmp

Filesize
2.2MB

Download
memory/4720-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4720-40-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/5004-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/5004-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/5004-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/5004-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download