b103603dcb70156ff93327b4f3146161c5d385109a47abb2a7ecd440e4a7c5b0

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 23:18

Target

3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe
Size

23KB
MD5

3264dbda849bc7fe3d3bd52b4a58880b
SHA1

e68cb8299ac48de28d6ec1044811d4296231f1e5
SHA256

b103603dcb70156ff93327b4f3146161c5d385109a47abb2a7ecd440e4a7c5b0
SHA512

b9661e3474ed3ab6e9a7caaef882449eb261c707ed2efcb118ff5acebba100a0e6b97979c111fa396b33bd8668061d0a0b69cb3497a9fc44b4a4a7dff3e4730d
SSDEEP

384:fvLCvV7Q+1xJKVbu/3UNUG8Ut4QJKfykS3UVKCNIPK7n2tL34oa9VigNDw:fD8AgkuG77KfW3hzS7nkL34f7

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1920	cmd.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2520-15-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2108-4-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2108-6-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2108-5-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2520-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/2108-17-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	204.117.214.10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\icf.exe	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe:exe.exe	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\icf.exe	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 2108	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2108	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2108	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2108	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2108	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2108	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	30
PID 2520 wrote to memory of 1920	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	31
PID 2520 wrote to memory of 1920	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	31
PID 2520 wrote to memory of 1920	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	31
PID 2520 wrote to memory of 1920	2520	3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3264dbda849bc7fe3d3bd52b4a58880b_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\2818051.bat
  2⤵
  - Deletes itself
  PID:1920

C:\Users\Admin\AppData\Local\Temp\2818051.bat

Filesize
263B

MD5
0566eba379b3b6a59fd7a12507cad91d

SHA1
48dcba7a8b7668241d8b0fb0ed5b9e1b8be05506

SHA256
cd56d084c307fbd059cfaeef53699aa56c8bec8d3af72daf02416192b59e7f4a

SHA512
8b34ae70c79a8c0c9fe2ffedfcef706605aea01f919f3294116d087794c9519cb634092e13a037bcb87ebf3296866e8b6c613c7332d71e5de21605e85f402797

Download Submit
memory/2108-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2108-6-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2108-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2108-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2108-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2520-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2520-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download