09c347e889841e774178c5a4e55a61eb76ee6e17bf2796acfcf00207b55535f0

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
Size

74KB
MD5

70b2864116ee146a65a36b6b14475f0d
SHA1

2f3f30c40ac2115e6651e24f3f01242ed9373b89
SHA256

09c347e889841e774178c5a4e55a61eb76ee6e17bf2796acfcf00207b55535f0
SHA512

701a3c97bed205fbdce41dcda5b88067ed57682826604aee469c1896717507d4a6c05321707f815f6d5a9072c2e059d532a8036c3a59907f3f17337064925328
SSDEEP

1536:IlIG40khNo4L8ZFB8DCuV51GTaGIbWgP8OrLga:IlIGILs4CW51GTaGICgPZn

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4380-3-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-2-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/4380-4-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-6-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-7-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/4380-8-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-9-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-10-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-11-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-12-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-13-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-15-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-16-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-17-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-18-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4380-19-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4380	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3108	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
4380	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4380	3108	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe	92
PID 3108 wrote to memory of 4380	3108	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe	92
PID 3108 wrote to memory of 4380	3108	70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\70b2864116ee146a65a36b6b14475f0d_JaffaCakes118.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3108-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3108-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4380-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4380-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-4-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-15-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-17-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4380-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download