Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 07:15

General

  • Target

    25143789db4cabfb4fd13be26b2bef37_JaffaCakes118.exe

  • Size

    695KB

  • MD5

    25143789db4cabfb4fd13be26b2bef37

  • SHA1

    44a89925bf952ed5c2163111e5691b3e0419cfc9

  • SHA256

    90b490343798c334457d2f914d2d973147ac32734fe4df2a412c159d808e50b3

  • SHA512

    95e5237d9cc5092b1f32f1c1b47ae343dbb8c2c1ee937c890f28555e558d772025c3ef933053a20e0c4383c4419a8fc65e30e415680c90972ad3a4de4b08d5f0

  • SSDEEP

    12288:4ek0IxqFGy7XLiU+Vmo1wmSSKaJQtrVoaUA9vrzn43lHyo2z0rQAPOoz0/YRr:/fl7Xu7pwykrVoDQvP41Hyx0rQAPOozD

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25143789db4cabfb4fd13be26b2bef37_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\25143789db4cabfb4fd13be26b2bef37_JaffaCakes118.exe"
    1⤵
      PID:2224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 320
        2⤵
        • Program crash
        PID:2744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2224 -ip 2224
      1⤵
        PID:2072

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2224-0-0x0000000000950000-0x0000000000951000-memory.dmp

              Filesize

              4KB

            • memory/2224-1-0x0000000000980000-0x00000000009CE000-memory.dmp

              Filesize

              312KB

            • memory/2224-9-0x0000000075C60000-0x0000000075D50000-memory.dmp

              Filesize

              960KB

            • memory/2224-8-0x0000000075C80000-0x0000000075C81000-memory.dmp

              Filesize

              4KB

            • memory/2224-7-0x0000000002320000-0x0000000002330000-memory.dmp

              Filesize

              64KB

            • memory/2224-6-0x0000000002210000-0x0000000002220000-memory.dmp

              Filesize

              64KB

            • memory/2224-5-0x00000000021F0000-0x0000000002200000-memory.dmp

              Filesize

              64KB

            • memory/2224-4-0x0000000077782000-0x0000000077783000-memory.dmp

              Filesize

              4KB

            • memory/2224-2-0x0000000000400000-0x00000000004D2000-memory.dmp

              Filesize

              840KB

            • memory/2224-3-0x0000000002320000-0x0000000002330000-memory.dmp

              Filesize

              64KB

            • memory/2224-11-0x0000000000980000-0x00000000009CE000-memory.dmp

              Filesize

              312KB

            • memory/2224-12-0x0000000075C60000-0x0000000075D50000-memory.dmp

              Filesize

              960KB

            • memory/2224-10-0x0000000000400000-0x00000000004D2000-memory.dmp

              Filesize

              840KB