8d9f11ff135b108d6e33e5e82bcf004882dff3adcce72121994638772e9a7fbd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 11:28

Target

1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe
Size

28KB
MD5

1b1f658ad8f88cef643502ce7939b2d1
SHA1

95853ff9e9e836daf0be5b93bc121f523751d33c
SHA256

8d9f11ff135b108d6e33e5e82bcf004882dff3adcce72121994638772e9a7fbd
SHA512

16f108bae11dd96ae9ad43cf94a8cb2f5e4ac44adca9941e3f8e185de164f3c06f62e8f89e9d8426a7e990477425d5484521a4aeebf8ad0e52e39a865f5fb3b9
SSDEEP

768:1V+zQi6uTa+TS8Ejs9ddjXydQqbMmfwr:uUb+u8Eg9vjXydQFp

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1840	cmd.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2464-4-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/1848-13-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2464-15-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fci.exe	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fci.exe	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe:ext.exe	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 2464	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2464	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2464	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2464	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2464	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	28
PID 1848 wrote to memory of 2464	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	28
PID 1848 wrote to memory of 1840	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	29
PID 1848 wrote to memory of 1840	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	29
PID 1848 wrote to memory of 1840	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	29
PID 1848 wrote to memory of 1840	1848	1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b1f658ad8f88cef643502ce7939b2d1_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\196611.bat
  2⤵
  - Deletes itself
  PID:1840

C:\Users\Admin\AppData\Local\Temp\196611.bat

Filesize
260B

MD5
b24f55a168de054185c813787bff59f9

SHA1
6d3b44fe0ad6090be723558bb47c570ba126c076

SHA256
2313c6db9ff914c6b4ded956e9a7f54e72521edd536f28a3b7e9b941bb18cbab

SHA512
2cf79af407ed4b7197c9e94506022859fb7d9bd93fcf0d0611d21db24ca7c0f97dc8caa397dee9d2fb664c06d0d6de8b5d3d7f2b2f58ba0f0afff685b062fdf2

Download Submit
memory/1848-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1848-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2464-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2464-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2464-15-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download