abc1fb687fc4e65f2b791923cb76dab88067c0e1e115cdf97b41a97ee3e5a8b0

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 17:47

Target

0857f2c8541dba287d648eec17163d3f_JaffaCakes118.exe
Size

289KB
MD5

0857f2c8541dba287d648eec17163d3f
SHA1

8ed85dfd683be2919a1b612d1d924720d962d0a0
SHA256

abc1fb687fc4e65f2b791923cb76dab88067c0e1e115cdf97b41a97ee3e5a8b0
SHA512

f83957775fd9a2f840d0e50d8ca36c92209a6cf989adfca866b043281f05825de5bb0079c535d346e6aa2e629772bdd45148ef02b81026bac97e6248271888f1
SSDEEP

6144:5NENowLmN7JVb3hwwDX+l5F7l1k5u8vk3U4pT+PhrWHoS:5RvNdV7rDX+zF7lquQaYh6HoS

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
5096	RemoteAbc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5076-0-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral2/files/0x00080000000233e9-3.dat	upx
behavioral2/memory/5096-5-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral2/memory/5076-11-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral2/memory/3116-10-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral2/memory/5096-13-0x0000000000400000-0x0000000000493000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2636	3116	WerFault.exe	86

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 3116	5096	RemoteAbc.exe	86

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\system32R_Server\RemoteAbc.exe	0857f2c8541dba287d648eec17163d3f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2656	5076	0857f2c8541dba287d648eec17163d3f_JaffaCakes118.exe	85
PID 5076 wrote to memory of 2656	5076	0857f2c8541dba287d648eec17163d3f_JaffaCakes118.exe	85
PID 5076 wrote to memory of 2656	5076	0857f2c8541dba287d648eec17163d3f_JaffaCakes118.exe	85
PID 5096 wrote to memory of 3116	5096	RemoteAbc.exe	86
PID 5096 wrote to memory of 3116	5096	RemoteAbc.exe	86
PID 5096 wrote to memory of 3116	5096	RemoteAbc.exe	86
PID 5096 wrote to memory of 3116	5096	RemoteAbc.exe	86
PID 5096 wrote to memory of 3116	5096	RemoteAbc.exe	86

C:\Users\Admin\AppData\Local\Temp\0857f2c8541dba287d648eec17163d3f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0857f2c8541dba287d648eec17163d3f_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\862977.bat
  2⤵
  PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3116 -ip 3116
1⤵
PID:4248

C:\Program Files (x86)\system32R_Server\RemoteAbc.exe

Filesize
289KB

MD5
0857f2c8541dba287d648eec17163d3f

SHA1
8ed85dfd683be2919a1b612d1d924720d962d0a0

SHA256
abc1fb687fc4e65f2b791923cb76dab88067c0e1e115cdf97b41a97ee3e5a8b0

SHA512
f83957775fd9a2f840d0e50d8ca36c92209a6cf989adfca866b043281f05825de5bb0079c535d346e6aa2e629772bdd45148ef02b81026bac97e6248271888f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\862977.bat

Filesize
218B

MD5
8eb2ba318a26179abbae912686191faf

SHA1
9f1e27af546d67125c2ab8f792ce8ad8df00dff0

SHA256
a679a313c30f9a2b341b344276e33109b77509abed5d90f9dee540c60b36a85d

SHA512
eb4b4ea6a107b85ae68e13b769515836c844c0d322b33d7074388b9b304ddd3c71b5a07e1c6860285bbb57d0b7566ef17df05abb555a6e37cfe97c5e322eaf97

Download Submit
memory/3116-10-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5076-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5076-1-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/5076-11-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5096-6-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/5096-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5096-13-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download