ac05d8bc741317fcbf06abc51d3b8848ab8f16be9e4ac70c70e0ee62b199c98d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 19:02

Target

fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe
Size

1.3MB
MD5

fff4f4cd3ef2a43823729a741c473868
SHA1

178392f3daf150187ae53c834c4e00fd95abffc8
SHA256

ac05d8bc741317fcbf06abc51d3b8848ab8f16be9e4ac70c70e0ee62b199c98d
SHA512

862dcfeccc1782f1a58c29a30f4e1817709a95b58cf227371f07d98716cbfd8bc144d3dc639c75b3deb3e33ed9cdad86d90b1f04bcfdbf217a2527407d9a7e70
SSDEEP

24576:W562lVLUgaoBiu6bByNH8u/3Z3ZG4Lb57NfOifWAmOynznicpwGnh8I19IYWc:GlVLUg1iuc8NHB/ZJG4RNfkOynzngGnb

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
3068	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3068	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/672-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x000300000001e97a-11.dat	upx
behavioral2/memory/3068-14-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
672	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
672	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe
3068	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3068	672	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe	85
PID 672 wrote to memory of 3068	672	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe	85
PID 672 wrote to memory of 3068	672	fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\fff4f4cd3ef2a43823729a741c473868_JaffaCakes118.exe

Filesize
1.3MB

MD5
e9d5276e49b32243ffcfc1dd3b03d783

SHA1
995493503eb2e2c158dc683b732c38a02fa3c1e5

SHA256
754f5b825d1613d6d82b2dc6cfcce3f856f15bf31c7f3cae45c341e589d65e76

SHA512
17e9d89e9c5622ab615c8e3b7c1447f70a4990b336627309810ab5f065d60dc2b19402e6189ac42a90567ac9b3110387da5cb9409f3a65e8d71da06658f5dcf2

Download Submit
memory/672-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/672-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/672-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/672-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3068-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3068-14-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3068-16-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/3068-20-0x0000000005630000-0x000000000585A000-memory.dmp

Filesize
2.2MB

Download
memory/3068-21-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3068-40-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download