da35b394a58c6587eeb3155589a6f81bab35dc68dee475cb52f760e1818a40ba

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 21:12

Target

36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
Size

81KB
MD5

36661d917ef41f20fe8ef1eefb42cfd6
SHA1

0d0ee24c06dffe246abbbdc610cc4c287417ea78
SHA256

da35b394a58c6587eeb3155589a6f81bab35dc68dee475cb52f760e1818a40ba
SHA512

317951c989e6f905ee17150ef21244cddb4a4b29041e0ab3261969a5abbf996d3f510fb69d7cac88f7f19357072d237e50954dcbfba0785da21bdaf9035f70cb
SSDEEP

1536:BnO6kGMNkiwp2NAgTymr7qLXKeWCvyG2513B4ABdIA/zdrD2CGlbfpKeyOso3YXz:BO6HbiZNlTymrWLvJ251SiRX2fplFW

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2312-1-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2312-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Modifies registry class 7 IoCs

Processes:

36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\hfkxi\\command	36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\hfkxi	36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\hfkxi	36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36661d917ef41f20fe8ef1eefb42cfd6_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:2312

memory/2312-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2312-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download