656cd2ff33ea887836a16a873af2f47f41a95dd51d5e82238794796b8db32f4e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 00:32

Target

fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe
Size

1.8MB
MD5

fe01ebd468401ab0edddc217588ee2a9
SHA1

3bfbc9a3ba2a33ae4cccc6beb9af22389f25af56
SHA256

656cd2ff33ea887836a16a873af2f47f41a95dd51d5e82238794796b8db32f4e
SHA512

c7b0ee36c121e194451e0f18b64b4bfecf166e19862bcad48b7a0d0b6e4b03c8461deb03bed93a397830066dfdf6324ed83f6b5a393fb323cb887b9765525598
SSDEEP

24576:NybqU/AmvAwKbwCX4lRSuGwso9ipvXjcc1AeosWp0QZlE3hOwqcRiU:zU/2bwa4lEuGwsppzosVbhOwP

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1404	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1404	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4648-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000800000001db0e-11.dat	upx
behavioral2/memory/1404-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4648	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4648	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe
1404	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1404	4648	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe	85
PID 4648 wrote to memory of 1404	4648	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe	85
PID 4648 wrote to memory of 1404	4648	fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\fe01ebd468401ab0edddc217588ee2a9_JaffaCakes118.exe

Filesize
1.8MB

MD5
aa90a68eedd8fb10c4bb8014d37716fb

SHA1
80c2f2a3be15414f3b16c8299ab93d8297db5f7e

SHA256
c572293225184091bc63bf302eb9c18ed1b0a87a303c2e965d7a6a0e8a6b7826

SHA512
1dc0814ae4fc8577b7a147d1aa3d5673506885b138d51c764cf9fdd4dc28bdc5cb83906e286966e475de451c93044bff491e2edb8e5440849448fc13c2d3839b

Download Submit
memory/1404-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1404-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1404-14-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/1404-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1404-20-0x00000000055B0000-0x00000000057DA000-memory.dmp

Filesize
2.2MB

Download
memory/1404-42-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4648-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4648-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/4648-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4648-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download