581bfaa2729f7be4d390332e069568754a559eed55838981d1542669f7f72737

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 02:12

Target

3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Size

79KB
MD5

3fca0366078046f32cba836f8c8bece3
SHA1

89296d2c5264517503af900b6395d5e734083a05
SHA256

581bfaa2729f7be4d390332e069568754a559eed55838981d1542669f7f72737
SHA512

b94ddd357a97d38c6e7c62207d6f37f3c4bed0b0772a026418e1103ace47d9256feffdf006fc95b0f079900b5f33df3bc5c43aeaaab12678911015ba4c57aa3b
SSDEEP

1536:lfaWM+j/5sKgI88hmt5vKvTXr7NDFZ+oqVlNohEgsFzd7DgvglK+FBlkeqYcurTn:lfamLq8hwKv7Z+oagC5CUB9cuqnyB

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2772-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/2772-2-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\arqrk\\command	3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\arqrk	3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\arqrk	3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:2772

memory/2772-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2772-2-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download