0564485a47dcd739fe9a79f85ccc311bae4ed21bf5860011d6000b4cc4591c92

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 02:03

Target

374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe
Size

828KB
MD5

374b4a38a4cc8d687c87b0868cb71b90
SHA1

48a4c62588952da4e6f8e443174d05bb7d66a318
SHA256

0564485a47dcd739fe9a79f85ccc311bae4ed21bf5860011d6000b4cc4591c92
SHA512

55dcc8854e7f4ae1cced372c2adbe166fffadbedaf64c3b849b2d54eb52b8d4ffa692260f679840ea7e611af02d7ff5ee9a09bce813bf240be958c6da7ca82d5
SSDEEP

24576:ZDyTFtjSDyTFtjsDyTFtjSDyTFtjODyo1tj:utztZtztUt

Score

7^/10

upx

Executes dropped EXE 2 IoCs

pid	Process
2344	tmp259623306.exe
1912	tmp259623322.exe

Loads dropped DLL 4 IoCs

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2536-1-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2536-20-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\notpad.exe	tmp259623306.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp259623306.exe
File created	C:\Windows\SysWOW64\fsb.tmp	tmp259623306.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp259623306.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp259623306.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2344	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	29
PID 2536 wrote to memory of 2344	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	29
PID 2536 wrote to memory of 2344	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	29
PID 2536 wrote to memory of 2344	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	29
PID 2536 wrote to memory of 1912	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1912	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1912	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1912	2536	374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\374b4a38a4cc8d687c87b0868cb71b90_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\tmp259623306.exe
  C:\Users\Admin\AppData\Local\Temp\tmp259623306.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\tmp259623322.exe
  C:\Users\Admin\AppData\Local\Temp\tmp259623322.exe
  2⤵
  - Executes dropped EXE
  PID:1912

C:\Users\Admin\AppData\Local\Temp\tmp259623306.exe

Filesize
123KB

MD5
d58fe1e8fe18394e0995986429b2ca3b

SHA1
f73633b5b0b6c1224810f8472d16824cdeb132bc

SHA256
70fbc4f3e0a397e371637013d3ae26c3a7a806abc97d0ad4267d2d74400e8da4

SHA512
f2ae129f534bffa370e917c093b37ae993e1448e434dd283f09bbea896dab6c140bea37486a8cb93f3bf02eb1e987bfc9694fa52a85b5f74b07ada4b129d2634

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp259623322.exe

Filesize
67KB

MD5
5e28284f9b5f9097640d58a73d38ad4c

SHA1
7a90f8b051bc82cc9cadbcc9ba345ced02891a6c

SHA256
865f34fe7ba81e9622ddbdfc511547d190367bbf3dad21ceb6da3eec621044f5

SHA512
cb7218cfea8813ae8c7acf6f7511aecbeb9d697986e0eb8538065bf9e3e9c6ced9c29270eb677f5acf08d2e94b21018d8c4a376aa646fa73ce831fc87d448934

Download Submit
memory/2344-34-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2536-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2536-20-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download