86a0ee10ca3576f395a61629a77df8661de689bef20a24997fb29366d645fd81

Analysis

max time kernel
32s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 20:11

Target

432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe
Size

133KB
MD5

432bc832feb0987683dd0869fd99ca53
SHA1

199d0a5c5fa47053319356a985eb8f540fafcbcc
SHA256

86a0ee10ca3576f395a61629a77df8661de689bef20a24997fb29366d645fd81
SHA512

0e8a487a95b70b4786fa1f84efc06174217076c80308272ebc546cb14c5cd61df0f36a927198b8bc9f15099448d38d02cc699d8f94066956012bc2c7d56ccdf0
SSDEEP

3072:DEnGxrwR1n2FIFsz4K68xLWo8KJlOQbfx9iCnTyEqrVQ:wowRZ2F3bVNWo81QLiCnTyEwVQ

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2196	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2196	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1892	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1892-0-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-11.dat	upx
behavioral1/memory/2196-16-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1892	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1892	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe
2196	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2196	1892	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe	31
PID 1892 wrote to memory of 2196	1892	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe	31
PID 1892 wrote to memory of 2196	1892	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe	31
PID 1892 wrote to memory of 2196	1892	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe	31

\Users\Admin\AppData\Local\Temp\432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Filesize
133KB

MD5
db057d7288aae49e5257f5d4fdc25269

SHA1
ca8666477341b0cc30c4a89e2a611ea031346674

SHA256
da1db0bfc8ca26cc395ea07497619fd8656da78176130721bb043f5b80c0178c

SHA512
97ad8e138a87edc8f5317a3df8a45fd10097a9beae7cb09c5bfbf9b09325ba2b5a5c04f7d38da5ef62bcba46879df826be5b2275aa8cedf9f59273c1769dc672

Download Submit
memory/1892-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1892-10-0x0000000000150000-0x0000000000171000-memory.dmp

Filesize
132KB

Download
memory/1892-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1892-14-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2196-16-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2196-23-0x0000000000150000-0x0000000000171000-memory.dmp

Filesize
132KB

Download
memory/2196-40-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download