a5c89ba9e708daa3e9f8388bb6d4218a422061fe4057bf5868edfa685e236974

Analysis

max time kernel
149s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 08:14

Target

11d73c6a1062a7c2dd6932b6b482ec93_JaffaCakes118.exe
Size

1.6MB
MD5

11d73c6a1062a7c2dd6932b6b482ec93
SHA1

35f3767a7097f5abdc81b0b5b34adac209d6f3c9
SHA256

a5c89ba9e708daa3e9f8388bb6d4218a422061fe4057bf5868edfa685e236974
SHA512

60bbfa7560f4ef6d14ccc96b5ce6a665352e24834146753cad80e2391db766209067bc21ca1ba26dd7c6cba94c51fcc07a9915c2f2bb4fc38a301d86543d598b
SSDEEP

24576:s3o5GN+NM2HAd58jf6ufnet8GXiqb88yUQZuF8j+vxiATCrwvgXLBHPKchiMAzi3:s3gGSl48GXP88CuF86vRCjnsMAz4

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1396-0-0x0000000000400000-0x0000000000891000-memory.dmp	upx
behavioral2/memory/1396-2-0x0000000000400000-0x0000000000891000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	11d73c6a1062a7c2dd6932b6b482ec93_JaffaCakes118.exe
1396	11d73c6a1062a7c2dd6932b6b482ec93_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\11d73c6a1062a7c2dd6932b6b482ec93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11d73c6a1062a7c2dd6932b6b482ec93_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396

memory/1396-0-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1396-1-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/1396-2-0x0000000000400000-0x0000000000891000-memory.dmp

Filesize
4.6MB

Download
memory/1396-4-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download