19e25ad075e712f692d1ceb72eb33716dc05b1ce17fb6c49b62ac0d718745851

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 13:17

Target

26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
Size

86KB
MD5

26f02f78c9187e46be71f479f775fb49
SHA1

37932fcb87948d10ad8c481d5761cb6c9a7e1c97
SHA256

19e25ad075e712f692d1ceb72eb33716dc05b1ce17fb6c49b62ac0d718745851
SHA512

1593d74d33f7cb941303a4207e1b6dbe6be81414ae3d313c80a3782c226c6e18f953fdd3cd179ff8b91848dcad7b8cf887a93f082fb2439ac499708c49c7d6b8
SSDEEP

1536:tDprbTFL3YmkLZjcWelwZ0So+HKfzUBzLfvJk2JpR5GKu9AOZJxVW49sYBUg385I:lt9L386hlwWSFPfBk8nGKu9AO/xVWusG

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2168-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2168-2-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\oxqkh\\command	26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\oxqkh	26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\oxqkh	26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26f02f78c9187e46be71f479f775fb49_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:2168

memory/2168-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2168-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download