09c347e889841e774178c5a4e55a61eb76ee6e17bf2796acfcf00207b55535f0

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
Size

74KB
MD5

70b2864116ee146a65a36b6b14475f0d
SHA1

2f3f30c40ac2115e6651e24f3f01242ed9373b89
SHA256

09c347e889841e774178c5a4e55a61eb76ee6e17bf2796acfcf00207b55535f0
SHA512

701a3c97bed205fbdce41dcda5b88067ed57682826604aee469c1896717507d4a6c05321707f815f6d5a9072c2e059d532a8036c3a59907f3f17337064925328
SSDEEP

1536:IlIG40khNo4L8ZFB8DCuV51GTaGIbWgP8OrLga:IlIGILs4CW51GTaGICgPZn

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-5-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-4-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2356-6-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-8-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-10-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2356-11-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-12-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-13-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-14-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-16-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-18-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-19-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-20-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2356-21-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2356	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1704	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
2356	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2356	1704	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2356	1704	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2356	1704	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2356	1704	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1704-1-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/1704-9-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/1704-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2356-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2356-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-14-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2356-21-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download