d4a45a30c474cce5a4730a7fbbc061e0fbde1b180e79ea98871ab9f1905939af

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 04:46

Target

3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
Size

79KB
MD5

3357ea8b6b6af30d970b6f2ad8dc9e32
SHA1

577120d18bfc351d4d67124afdd4575c5fb69c8b
SHA256

d4a45a30c474cce5a4730a7fbbc061e0fbde1b180e79ea98871ab9f1905939af
SHA512

9bb73e45dbf10d797da8cf5b44b47fd772813c2fae09cd67e58dbd86201ad5371047092a89f3ecb40d68fb1eb8ec7b249c02f360700c1783680d2b64f32be859
SSDEEP

1536:y4cByAlnenQPb6TiBXhuo2hI0hwyexCWDvChRBYAuRNMfx:ydyjQPGTiBXX7iwytWDahRBYAuN4x

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2704-1-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\ydpqg	3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\ydpqg\\command	3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\ydpqg	3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3357ea8b6b6af30d970b6f2ad8dc9e32_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:2704

memory/2704-1-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download