86a0ee10ca3576f395a61629a77df8661de689bef20a24997fb29366d645fd81

Analysis

max time kernel
93s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 20:11

Target

432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe
Size

133KB
MD5

432bc832feb0987683dd0869fd99ca53
SHA1

199d0a5c5fa47053319356a985eb8f540fafcbcc
SHA256

86a0ee10ca3576f395a61629a77df8661de689bef20a24997fb29366d645fd81
SHA512

0e8a487a95b70b4786fa1f84efc06174217076c80308272ebc546cb14c5cd61df0f36a927198b8bc9f15099448d38d02cc699d8f94066956012bc2c7d56ccdf0
SSDEEP

3072:DEnGxrwR1n2FIFsz4K68xLWo8KJlOQbfx9iCnTyEqrVQ:wowRZ2F3bVNWo81QLiCnTyEwVQ

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
3444	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3444	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1012-0-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral2/files/0x00090000000234ae-11.dat	upx
behavioral2/memory/3444-13-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1012	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1012	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe
3444	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 3444	1012	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe	85
PID 1012 wrote to memory of 3444	1012	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe	85
PID 1012 wrote to memory of 3444	1012	432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\432bc832feb0987683dd0869fd99ca53_JaffaCakes118.exe

Filesize
133KB

MD5
6580aa3b7b14131a24e59d721b0136bc

SHA1
8dbddf8e5632217f102a3f69a53528dd57027656

SHA256
8b5134078e3c38327d67bea348826f3eb45309854710f1d948b14333f70ceefe

SHA512
737f44216cc8bfd3f03c8b0d76893fd7b65292a58c134cc44ecaf3f554359243227c41d015eb81137aa9aacacd831c881a123a42bce4351d673a876cc5e53951

Download Submit
memory/1012-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-1-0x00000000015A0000-0x00000000015C1000-memory.dmp

Filesize
132KB

Download
memory/1012-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1012-14-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3444-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3444-15-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/3444-16-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3444-36-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download