2e678d9172c835c3c7d96b11d8b94ca523768b5f42c7cf10e752c2db268da695

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 08:52

Target

21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
Size

79KB
MD5

21c49f8ba711241ade33c960dccc20e8
SHA1

87bef3d0ecbd10a998ad5b73a3a8174675cb9c54
SHA256

2e678d9172c835c3c7d96b11d8b94ca523768b5f42c7cf10e752c2db268da695
SHA512

825f5d6db1239afb3a119de7a71f5c5aaa0b5f94abc1baed3c6227516b8763150558c31d91c8ee6ce6959df6bde311c8ed86552ed7f9329e0e163faf2af6c63e
SSDEEP

1536:dz8pccppJTEerrvZmViKS/JGZfnhjOQZa2HweHG3W:difLLrrvKZhyQkYwL3W

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2180-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2180-2-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\bgjkt\\command	21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\bgjkt	21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\bgjkt	21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21c49f8ba711241ade33c960dccc20e8_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:2180

memory/2180-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2180-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download