79ab982cf017ae4c04c4c7bef43ff91dac1f65f9accad8cb2ff65a6de549c885

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
Size

342KB
MD5

8d1b7bd6beb944664dfd4089296e30ab
SHA1

4d14b519fe5602c978ea9499f23dcda748955f22
SHA256

79ab982cf017ae4c04c4c7bef43ff91dac1f65f9accad8cb2ff65a6de549c885
SHA512

5368919d0e994268a41a04c6a1de0a0fb0597425723f56d1d0a719575db463aa7cd6e11717dd0606891cdaccb58f6e7626a31021c7a3e8dcb4aebb242a8852b0
SSDEEP

6144:g24xdmeelefkfJxYvTr93atj2XpdzErru1pNV0IgpdJ57QNpalyYYYY6YYYYYYYN:aSee0fWJevTpgAdz4ru1pNV0vp5QK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1448-0-0x0000000000400000-0x00000000004AF000-memory.dmp	upx
behavioral2/memory/1448-37-0x0000000000400000-0x00000000004AF000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	1448	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3584	1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe	94
PID 1448 wrote to memory of 3584	1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe	94
PID 1448 wrote to memory of 3584	1448	8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8d1b7bd6beb944664dfd4089296e30ab_JaffaCakes118.exe"
  2⤵
  PID:3584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 428
  2⤵
  - Program crash
  PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1448 -ip 1448
1⤵
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1448-1-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-36-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-35-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-34-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-33-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-32-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-31-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-30-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-29-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-28-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-27-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-26-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-25-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-24-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-23-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-22-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-21-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-20-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-19-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-18-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-17-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-16-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-15-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-14-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-13-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-12-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-11-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-10-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-9-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-8-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-7-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-6-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-5-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-4-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-3-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-2-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1448-37-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download