f725eba756edaa8f7410b10a15e05141e2613b5d38fa4172b092261d66dbc554

Analysis

max time kernel
92s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 08:07

Target

2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe
Size

133KB
MD5

2f9460313f9c3161360261123cbdf504
SHA1

a0d5f5149231a6f1b0a677c8079c491a54756797
SHA256

f725eba756edaa8f7410b10a15e05141e2613b5d38fa4172b092261d66dbc554
SHA512

d70320743655002d1688102e6b449949f38f9d10288f5211d965710fa87cde6d66ae5f3175c2fb592e20c67140dde160d1f2b947535cb65416e23b2ecfc5fad9
SSDEEP

3072:hi0/YIlzQruqbCLxvPgUgVl2L6DFpM9tAuFR3GkOIusQyInBs6cQ:PllzQyqA8Vl3fkEYEK6cQ

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
4788	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4788	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1252-0-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral2/files/0x0009000000023405-13.dat	upx
behavioral2/memory/4788-15-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1252	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1252	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe
4788	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 4788	1252	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe	83
PID 1252 wrote to memory of 4788	1252	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe	83
PID 1252 wrote to memory of 4788	1252	2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe

Filesize
133KB

MD5
0c1222304ee39d720d802c6297e52b89

SHA1
28f727ed1c3641a41464125923adc6cb9fb2759b

SHA256
5fb88e7469ea4057720c362b68019ba12936caeac351cc9141d9e28dce4f199e

SHA512
68f6c6563e12de6be69827c2eb2ac2ec6c3b87fd0bceac5db97db553a5752df2d5fe73ca47fb9ce0044d0ddfec1a86195bfc750d774c015cea6230305483c64a

Download Submit
memory/1252-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1252-1-0x0000000001560000-0x0000000001581000-memory.dmp

Filesize
132KB

Download
memory/1252-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1252-14-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4788-15-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4788-16-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4788-22-0x00000000001C0000-0x00000000001E1000-memory.dmp

Filesize
132KB

Download
memory/4788-30-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download