18d28fc618ccdb4dd8a0986c5ceaba70e23b534eb4590b1af1e69a037e42b001

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 11:19

Target

ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe
Size

1.5MB
MD5

ff2977b9b57165cee007f1e92203865c
SHA1

ea7e6c587973751d472cd154e1c5a4729cfc7ddd
SHA256

18d28fc618ccdb4dd8a0986c5ceaba70e23b534eb4590b1af1e69a037e42b001
SHA512

50aaab1c29ee9995761f8016a38c73d5355c533fb3e1d2751ef2efd590db1046e90e2ee809011ea971625b0fb6fe40a5a6976b18b07bf397cab60f490b061e9e
SSDEEP

24576:DCscqnwuUaiyjMBrhBHqULRqbYAyFIdmiSytLQnTjfBQHV/x3H3GUc4nJPEW:DCtsgavjMTxbt1KdmiXtLeXfBQj3WJ4+

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4016	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4016	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4276-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0008000000023250-11.dat	upx
behavioral2/memory/4016-13-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4276	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4276	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe
4016	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4016	4276	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe	92
PID 4276 wrote to memory of 4016	4276	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe	92
PID 4276 wrote to memory of 4016	4276	ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2432

C:\Users\Admin\AppData\Local\Temp\ff2977b9b57165cee007f1e92203865c_JaffaCakes118.exe

Filesize
1.5MB

MD5
3ddda33809a9457c93fc68ddba58fa01

SHA1
e400d542575eb2980d0f430679a1af7a6fd6c989

SHA256
7a1b7aee92a07c9e24e7ac60e5a87f27ad11eb2d75bce9024f6663434b7f811f

SHA512
4cece400b4df3bc5905a2a0b2cd1bc79530618c63660cc604422cb1c0143f2c93ef2dbd7ff9b6ae9e15549f311c6e142178f45f85906a66935398f4f6d81c1bb

Download Submit
memory/4016-13-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4016-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4016-14-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/4016-20-0x0000000005580000-0x00000000057AA000-memory.dmp

Filesize
2.2MB

Download
memory/4016-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4016-40-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4276-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4276-1-0x0000000001D00000-0x0000000001E33000-memory.dmp

Filesize
1.2MB

Download
memory/4276-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4276-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download