be529f1be66a4cddd4078693ecffc02c9d17584125c34a117d56174e775d170b

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:04

Target
a3c57ef18118510b7dd712aa2b83ee6c_JaffaCakes118.exe
Size 12.1MB
Sample240613-endxvatdpg
SHA256 be529f1be66a4cddd4078693ecffc02c9d17584125c34a117d56174e775d170b
MD5 a3c57ef18118510b7dd712aa2b83ee6c
SHA1 ba0397c2791999d77fe69a918c30b42c0bf59228
SHA512 0fed008607b1b448769d948dac15677ef5941d4ff9ac5d2a97a31609d6d7c2db7bb4c6ca954e0a21119a79a1967a3cb74009d1b0ad29e984f7f1f643fe7e22a6
SSDEEP 196608:eEsuXKs069MmUM4BZZhiO03nzULm2iaakhwgmaedVgz0Kqicte4B+iH+wjtW7:eeO697KZ4B3wLPiUeXMqic/ewjY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1456-0-0x0000000000400000-0x000000000047E000-memory.dmp	upx
behavioral2/memory/1456-29-0x0000000000400000-0x000000000047E000-memory.dmp	upx

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ITVA	a3c57ef18118510b7dd712aa2b83ee6c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ITVA\ = "E0490CA40EF09C75"	a3c57ef18118510b7dd712aa2b83ee6c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a3c57ef18118510b7dd712aa2b83ee6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3c57ef18118510b7dd712aa2b83ee6c_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4512,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
1⤵
PID:4952

21.jpg

Path C:\Users\Admin\AppData\Local\Temp\ii_D60D\0\21.jpg
Size 130KB
SHA256 899f7c4d070f84e9300ea28f3df24933b3dd7253860868e3d62bcd69a5db42f6
MD5 566c716cac5cb14f734451c3cf7ffb9f
SHA1 f4ff2ef532292c0ad94f4911701a9d35f7de4361
SHA512 864506f9f140c3781fdcc130517f3ed2b67d7a4b66e5bbe5dc7e89f698fd0a784dc6a477b87fe7abfda953876adb2e32297391afbc4652a359b5879a2cddcca6
SSDEEP 3072:OYnz7kqc+cy4coBCTF2L+G71N3hSz16sDMA4BqHllj4OWj8/u37Nl:3z7kMpoBQ2LxP3MvDQg2r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-0-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1456-29-0x0000000000400000-0x000000000047E000-memory.dmp

Download