c997603dfcd9c2400cb3d2aeb64784c4005a66a953b57224b41fe84ebad0eb88

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 00:55

Target

3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
Size

83KB
MD5

3718dd6afb127356499d981f5499000f
SHA1

576b3e70a6f9e219545f692632a55ba572f9a788
SHA256

c997603dfcd9c2400cb3d2aeb64784c4005a66a953b57224b41fe84ebad0eb88
SHA512

f1e3830677823d89429cc0c5c3ae9c9659974367b58887cadf66defcb4ba8a3b3a9692a215275e48135f86460c2fd41aae9da8a3bc37917068350544a2b584d5
SSDEEP

1536:/g7CrtriERRHSrkrBEmLID3mLKaMPqCe/UjsBgdtOu1ZSpNxzXNV05jkV1F:/g7CrZiELi426nLKoKsBdu1sTXNwjC1F

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5064-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/5064-2-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\dttqz\\command	3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\dttqz	3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\dttqz	3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3718dd6afb127356499d981f5499000f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3718dd6afb127356499d981f5499000f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3718dd6afb127356499d981f5499000f_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:5064

memory/5064-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5064-2-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download