e7975e4dce0f8070e0e99492d4bdd8e89b406ae48a36728daa1592b394cdfcbf | Triage

Analysis

max time kernel
79s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 19:56

Sharing

Report Analysis Logs

General

Target

17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe
Size

31KB
MD5

17531f25cfacf2d072048f555e19b111
SHA1

de32e6bf5efcadd783a242d751c610266d1c366a
SHA256

e7975e4dce0f8070e0e99492d4bdd8e89b406ae48a36728daa1592b394cdfcbf
SHA512

84fd41ec6c1eda50e0cc7e2496b5652afc121a757bada8507564c5b821ede72456071841bc8e8f763848be9d459df00a333f452f92a8038286924be2e686895d
SSDEEP

768:iglI5snqq2fIk8Z2I90NQ66bfQgkKXwR:di5/7I90q6sEowR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4800-0-0x000000002AA00000-0x000000002AA20000-memory.dmp	upx
behavioral2/memory/4800-2-0x000000002AA00000-0x000000002AA20000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
700	4800	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe"
1⤵
PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 524
  2⤵
  - Program crash
  PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 4800
1⤵
PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4800-0-0x000000002AA00000-0x000000002AA20000-memory.dmp

Filesize
128KB

Download
memory/4800-1-0x0000000000620000-0x0000000000623000-memory.dmp

Filesize
12KB

Download
memory/4800-2-0x000000002AA00000-0x000000002AA20000-memory.dmp

Filesize
128KB

Download