94070e07d1c20bc0ad463a530f380c661317a3bbba7018c6dca482c90e414a2f | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 13:13

Sharing

Report Analysis Logs

General

Target

5c15d4b98a8af9d3f80d11e5876c65e0_JaffaCakes118.exe
Size

15KB
MD5

5c15d4b98a8af9d3f80d11e5876c65e0
SHA1

4564300aaf3f96a4032d9f5e064ac9230919b29c
SHA256

94070e07d1c20bc0ad463a530f380c661317a3bbba7018c6dca482c90e414a2f
SHA512

eb4f3693eb76599d123f9b8ab326fd1fac4bdb9735f5977796fc5c9995fcf34bd0012b721025275affd1c7fd24d37213c2f1b0492a9b380c815e158635e40dc4
SSDEEP

384:feq0c654NUQiP4mLw04MyQLpxnKhn2sY7:B0cGbr4g4KLbnKbY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3580-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3580-2-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4988	3580	5c15d4b98a8af9d3f80d11e5876c65e0_JaffaCakes118.exe	84
PID 3580 wrote to memory of 4988	3580	5c15d4b98a8af9d3f80d11e5876c65e0_JaffaCakes118.exe	84
PID 3580 wrote to memory of 4988	3580	5c15d4b98a8af9d3f80d11e5876c65e0_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\5c15d4b98a8af9d3f80d11e5876c65e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c15d4b98a8af9d3f80d11e5876c65e0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c " del "C:\Users\Admin\AppData\Local\Temp\5c15d4b98a8af9d3f80d11e5876c65e0_JaffaCakes118.exe""
  2⤵
  PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3580-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3580-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download