cddbfbb6a533357027f8729cee8003a90448039cab05f5572c4d687e3c38947b | Triage

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 16:14

Sharing

Report Analysis Logs

General

Target

3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe
Size

99KB
MD5

3575f13330675d8c948e32225479fa4f
SHA1

b187f03b5b0bcbf04b35c5b68911b273f7b60dab
SHA256

cddbfbb6a533357027f8729cee8003a90448039cab05f5572c4d687e3c38947b
SHA512

6695964929984ad740364765bd1e4376fd43ecdfedaf6f15156c689f14b9116e51739a03b29aac1714e9fabc9948a8777e2160b75cc61df9489b871b03dc9ba0
SSDEEP

3072:3hRFWqHKx2pZW1XpWFozsk7qVMKZP1psy:xXW6pyskGP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3632-0-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3632	3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4160	3632	3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe	85
PID 3632 wrote to memory of 4160	3632	3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe	85
PID 3632 wrote to memory of 4160	3632	3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe	85
PID 3632 wrote to memory of 4160	3632	3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe	85
PID 3632 wrote to memory of 4160	3632	3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3575f13330675d8c948e32225479fa4f_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3632-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/3632-2-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/3632-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download