d7c802d9065cc228b149783a60935fbbc70da885c02c8fe4631b5f35a77ddbbe

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 06:15

Target

2f43ef54e5ed9499a18af2e6041c54e6_JaffaCakes118.exe
Size

76KB
MD5

2f43ef54e5ed9499a18af2e6041c54e6
SHA1

5a0b4812d8e78d4bec2d87fb2a9036bcf3eec3b4
SHA256

d7c802d9065cc228b149783a60935fbbc70da885c02c8fe4631b5f35a77ddbbe
SHA512

c10e086020607f0f15fa1121f1b86b2589fe4d05348a30376b69d3b45aaa29f7ccc0abb10b4180447cf9289e3319ca37ecabed47f2f008bb4c918e2757687bcc
SSDEEP

768:tDPUxlDmJI6cQdP42F+mdTKS2POseC12GKwaw+SGypjvTa1n1lDEWYihmfrtQ:tDSaKQdtF+kTl2yAzKwiYbToEWBmfpQ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1348-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/1348-9-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gbvgbv06.exe	2f43ef54e5ed9499a18af2e6041c54e6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gbvgbv06.exe	2f43ef54e5ed9499a18af2e6041c54e6_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fonts\dbr06047.ttf	2f43ef54e5ed9499a18af2e6041c54e6_JaffaCakes118.exe
File opened for modification	C:\Windows\fonts\dbr06047.ttf	2f43ef54e5ed9499a18af2e6041c54e6_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	1348	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\2f43ef54e5ed9499a18af2e6041c54e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f43ef54e5ed9499a18af2e6041c54e6_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 316
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1348 -ip 1348
1⤵
PID:4272

memory/1348-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1348-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download