c6a04ba55a2a140878b0ce575c6212748b4a55b0a0449b3f8ec0c4b350f217ab

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 11:23

Target

10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe
Size

98KB
MD5

10660987d2359d92a5a1102e4697eb02
SHA1

9de843cf2d8597b49a204bcb451e3a545b943995
SHA256

c6a04ba55a2a140878b0ce575c6212748b4a55b0a0449b3f8ec0c4b350f217ab
SHA512

61373c2c5b6ac29cbf629accba35fa585162b037e5eecbf4e822b4ce7190e6a5a2e12f1e30725571922c27a1763d201405efc8703aab5b6963d5c4680b882b91
SSDEEP

3072:Dcp2VlGicx6STryuCrBbrj+ZhPo2oBjyAoutJ5vo:Ip+Gicx6SH/CAZONYAoSJ5vo

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000230000-0x000000000026D000-memory.dmp	upx
behavioral1/memory/2276-40-0x0000000000230000-0x000000000026D000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2156	2276	10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2156	2276	10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2156	2276	10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2156	2276	10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10660987d2359d92a5a1102e4697eb02_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  PID:2156

C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
1KB

MD5
ff1e83613d7a34c9c4ff8634533fc443

SHA1
17747d3a07dcfdfe77363f0ab7b1fb627a83beb1

SHA256
85b61bd2c529778bb4e9d9cd78642bfa6e8e4e13163c0d3816f0c6b3410c980f

SHA512
f3dc48647a3b6d56cbc08b6960a9f8084b164dd781004b3e7f5f01357a0aeceeadfa9dcd51ef8dccedc953103288bb7018cfdcd1042e50e767e6fd137cfdc100

Download Submit
C:\Users\Admin\AppData\Local\Temp\Downloader.log

Filesize
5KB

MD5
b87e808cce530be91a44d974dfc2a582

SHA1
28c6448b3149cbf9e709aa39201c2548122c46aa

SHA256
77f26ae48aef5a2d3c8ea876b7dc97cba25518d6cb9327fa2f1c01e556009111

SHA512
4feec531e3b0015f00d7eb89020f777c84742ab889126b36ed11152a4e2dcb2ef38a7c9d816d72f83eedf4cd438293b31c5ea6bd054bf2863307f6aac24c63eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\hd.vbs

Filesize
245B

MD5
d8682d715a652f994dca50509fd09669

SHA1
bb03cf242964028b5d9183812ed8b04de9d55c6e

SHA256
4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba

SHA512
eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca

Download Submit
memory/2276-0-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download
memory/2276-40-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download