26d47b17c3c0c515847fc170189e5eded8a2fdc6b3708164af0f2d99ea63e41e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 20:39

Target

2db87aebcb63330c90681516b849febe_JaffaCakes118.exe
Size

279KB
MD5

2db87aebcb63330c90681516b849febe
SHA1

6840bc2736c64db7ed65eda1dbad34fb557fda20
SHA256

26d47b17c3c0c515847fc170189e5eded8a2fdc6b3708164af0f2d99ea63e41e
SHA512

23f164b3c38ea0d3449a3a2d725b1e748457c4529a21211499efbd80634a00ebc8cc978c00e98532785323cf8d308bd7840ee1fd9cbdd05bed4c880b413b82de
SSDEEP

6144:MpGIjyuND5Iuodp2UPv8729JF+fpARPgiQoVNC22uorqc5O2fn:MJ11Ouod5jF+aQoVNh1i31n

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2412	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2452-0-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral1/memory/2452-11-0x0000000000400000-0x00000000004BC000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\F_Server.exe	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe
File opened for modification	C:\Windows\F_Server.exe	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2408	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	31
PID 2452 wrote to memory of 2408	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	31
PID 2452 wrote to memory of 2408	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	31
PID 2452 wrote to memory of 2408	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	31
PID 2452 wrote to memory of 2412	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	32
PID 2452 wrote to memory of 2412	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	32
PID 2452 wrote to memory of 2412	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	32
PID 2452 wrote to memory of 2412	2452	2db87aebcb63330c90681516b849febe_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\2db87aebcb63330c90681516b849febe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2db87aebcb63330c90681516b849febe_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" ¨Á
  2⤵
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Deleteme.bat
  2⤵
  - Deletes itself
  PID:2412

C:\Windows\SysWOW64\Deleteme.bat

Filesize
218B

MD5
b5ba5370746e6d6d7fcf83fff5e390fc

SHA1
794f74ce19f867b0eac80cc334cbe506e836fa1d

SHA256
6147b6d6373af3233b8017495d2f0812f734d09968c0a2530aef96caa205b8be

SHA512
03103dcaa1ed29cc00075c8d3f2dd08b334b4fd9ee7e068877a970355208d483f0c68c7af888ce4897f0afdbfbb23d4eb648950711490537496933846a4b6637

Download Submit
memory/2452-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2452-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2452-11-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download