8d0cc96739be0ee1d26ed59d27edcf02d89d189852fbd55bb82899cc493f3090

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 17:25

Target

0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe
Size

133KB
MD5

0eea4bdd41737c3566b163db257b103b
SHA1

f5368851e1f499dd7ac986421493efca8369faa4
SHA256

8d0cc96739be0ee1d26ed59d27edcf02d89d189852fbd55bb82899cc493f3090
SHA512

597128e623643fdbdc3cfe41dced7892512bf175ada1aea578309a4a6fa61ee8481ddbe8fe33a44e5d3556f989fa3ef1309595743b30dad36711c874c47738fc
SSDEEP

3072:65pul/rzsDYfatqv2AtDio2dvbF2h18eBrz/4ECR+/zyCa1Q:Ipunfwy2HXpbF2hOcC0mCa1Q

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2336	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3624-0-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral2/files/0x000900000002340c-12.dat	upx
behavioral2/memory/2336-14-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3624	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3624	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe
2336	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2336	3624	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe	82
PID 3624 wrote to memory of 2336	3624	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe	82
PID 3624 wrote to memory of 2336	3624	0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0eea4bdd41737c3566b163db257b103b_JaffaCakes118.exe

Filesize
133KB

MD5
32c3e21402b28348d1e4dfbcc7cfc2d7

SHA1
17628130889cf8ffc7493b778beddabaf5798239

SHA256
b72da9febf8c6aeb0dd08e2dc873c1ad8493621342edb1a74a75e72dc71bd5b8

SHA512
e02c2859b084f78051a96422ec40f0ce7eb8f88d6fd15d23bb19087df49ba928d90275732eee02cc76b5f6a90ad253e9edbdd52c376c5ed3e046b0fcfb937ad4

Download Submit
memory/2336-14-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2336-16-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2336-21-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/2336-22-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2336-23-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3624-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3624-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3624-7-0x00000000000F0000-0x0000000000111000-memory.dmp

Filesize
132KB

Download
memory/3624-13-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download