17606a4300eb7ba35eb309c9130056b88148f9694349e9ea9826a73c192d3eac

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 18:02

Target

3e54f3ce3682022abff346f2d6ad1f95_JaffaCakes118.exe
Size

17KB
MD5

3e54f3ce3682022abff346f2d6ad1f95
SHA1

399ac6ba82bd85745a9c7b27aad2b6683527019c
SHA256

17606a4300eb7ba35eb309c9130056b88148f9694349e9ea9826a73c192d3eac
SHA512

25d8b9928b13e820eed3cba425159f8488124657fe94ea722f4c7add19e39654e897563e8dd224348abf2f505aed6bda73cdc9314704c452944e4ec6a4a3dc8e
SSDEEP

384:6kA30Yany/6Ext5TtQ4u/wt7aaIhmXja4eAiMaNJawcudoD7UB7:6730GtQ41a3vFnbcuyD7U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
4132	3e54f3ce3682022abff346f2d6ad1f95_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4132-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4132-15-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3496	4132	3e54f3ce3682022abff346f2d6ad1f95_JaffaCakes118.exe	84
PID 4132 wrote to memory of 3496	4132	3e54f3ce3682022abff346f2d6ad1f95_JaffaCakes118.exe	84
PID 4132 wrote to memory of 3496	4132	3e54f3ce3682022abff346f2d6ad1f95_JaffaCakes118.exe	84
PID 3496 wrote to memory of 2920	3496	cmd.exe	86
PID 3496 wrote to memory of 2920	3496	cmd.exe	86
PID 3496 wrote to memory of 2920	3496	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\AE51.tmp\Trojan.DOS.FormatC.g.bat

Filesize
570B

MD5
9b7c2f555b68452f26129263a2f7d2b5

SHA1
33d3c3a98cbd25f6afd802f6185bebc42602a37b

SHA256
d87fde1c4c9ab1f713b847c1a5f644b210d1b0febadebded9988ad6b57fc5dd1

SHA512
5911cf888c0321ab1bcdb951c59af0d6eb7fab334884a6b6e9b8e9fef2f9139b0fbe3c3938d1d418e573e022e8cba41c24d6398512921005cb6ec0fdbbcff104

Download Submit
C:\Users\Admin\AppData\Local\Temp\AE51.tmp\b2e.dll

Filesize
31KB

MD5
7b860f28be19d4aef761fb991134a556

SHA1
0658a7456d0234dcca598b6ee599fe134d0ecd61

SHA256
57a2586d73188a694944c7da60c78380f82fac46452ed1a31c818ceb93e660bc

SHA512
a0685a25cbc3fff74aa4ad538ade5282242980f07fe1171e01644e0fa98e1ec6adc87b943290983f6fb5070d26fc15d697ae31a1f570e83e504ae1e4508aefa5

Download Submit
memory/4132-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4132-15-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download