16d4772424eeb8667df91341b73e1280bbf86b9bbef3e95b6bb13602e0762442

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 01:39

Target

44045058ad0b664510e3057cff66da25_JaffaCakes118.exe
Size

1.3MB
MD5

44045058ad0b664510e3057cff66da25
SHA1

65d2ad7365859e6e3a14a45e5c674a6616fc2e97
SHA256

16d4772424eeb8667df91341b73e1280bbf86b9bbef3e95b6bb13602e0762442
SHA512

9415023af1dbaaae4b0b13b9940f054c97f85bd47bb918d9b8801a272bd1a86b5687b2838a8cce253188368bdd35d37f6dade3a834346a769a820c7bd625ec38
SSDEEP

24576:uivxRhs4KqZ/20RvyiGkfqk9l8ZhNladZd9Oe9mMfJ93FXJkwv:u41Z/2KCkfqkj8Zh7KZdXmMfzZ

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4892-0-0x0000000000400000-0x000000000072E000-memory.dmp	upx
behavioral2/memory/4892-2-0x0000000000400000-0x000000000072E000-memory.dmp	upx
behavioral2/memory/4892-3-0x0000000000400000-0x000000000072E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	44045058ad0b664510e3057cff66da25_JaffaCakes118.exe
4892	44045058ad0b664510e3057cff66da25_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\44045058ad0b664510e3057cff66da25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44045058ad0b664510e3057cff66da25_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4892

memory/4892-0-0x0000000000400000-0x000000000072E000-memory.dmp

Filesize
3.2MB

Download
memory/4892-1-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/4892-2-0x0000000000400000-0x000000000072E000-memory.dmp

Filesize
3.2MB

Download
memory/4892-3-0x0000000000400000-0x000000000072E000-memory.dmp

Filesize
3.2MB

Download
memory/4892-4-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download