84983c4c04ccf4d8a13967fecad7b0140ea38410e37a432735a898174641474a

Analysis

max time kernel
137s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
Size

626KB
MD5

63023d98bdaea28a4089def821ea00d8
SHA1

a6fa02fb2fdbdc0f84f06d090c1f60f94f636b39
SHA256

84983c4c04ccf4d8a13967fecad7b0140ea38410e37a432735a898174641474a
SHA512

15e922cf1258bc52433a96d598d6229972749ae8e970aafd36d53448c3b58f93312e2d10345d12587d77ff850c70a10db5b93a271f10a74b1eb177a054ef68e0
SSDEEP

6144:XkAREGVT8PEZoTPFgBw6t9RJIH97g03S16IaMJYFHc0MKXn:X/NVTCESTPqBw6nIHxJrK3W

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2000	rlyspool.exe
2448	rlyspool.exe
2644	rlyspool.exe
2516	rlyspool.exe
2564	rlyspool.exe
1804	rlyspool.exe
1452	rlyspool.exe
1860	rlyspool.exe
2576	rlyspool.exe
1504	rlyspool.exe

Loads dropped DLL 20 IoCs

pid	Process
2988	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
2988	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
2000	rlyspool.exe
2000	rlyspool.exe
2448	rlyspool.exe
2448	rlyspool.exe
2644	rlyspool.exe
2644	rlyspool.exe
2516	rlyspool.exe
2516	rlyspool.exe
2564	rlyspool.exe
2564	rlyspool.exe
1804	rlyspool.exe
1804	rlyspool.exe
1452	rlyspool.exe
1452	rlyspool.exe
1860	rlyspool.exe
1860	rlyspool.exe
2576	rlyspool.exe
2576	rlyspool.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2988-0-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/files/0x000a0000000120d5-4.dat	upx
behavioral1/memory/2000-12-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2988-14-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2448-18-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2000-19-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2644-23-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2448-24-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2516-28-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2644-29-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2564-33-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2516-34-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/1804-38-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2564-39-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/1452-43-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/1804-44-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/1860-48-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2576-52-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/1860-53-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/1504-57-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral1/memory/2576-58-0x0000000000400000-0x000000000049F000-memory.dmp	upx

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2000	2988	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2000	2988	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2000	2988	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2000	2988	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe	28
PID 2000 wrote to memory of 2448	2000	rlyspool.exe	29
PID 2000 wrote to memory of 2448	2000	rlyspool.exe	29
PID 2000 wrote to memory of 2448	2000	rlyspool.exe	29
PID 2000 wrote to memory of 2448	2000	rlyspool.exe	29
PID 2448 wrote to memory of 2644	2448	rlyspool.exe	32
PID 2448 wrote to memory of 2644	2448	rlyspool.exe	32
PID 2448 wrote to memory of 2644	2448	rlyspool.exe	32
PID 2448 wrote to memory of 2644	2448	rlyspool.exe	32
PID 2644 wrote to memory of 2516	2644	rlyspool.exe	33
PID 2644 wrote to memory of 2516	2644	rlyspool.exe	33
PID 2644 wrote to memory of 2516	2644	rlyspool.exe	33
PID 2644 wrote to memory of 2516	2644	rlyspool.exe	33
PID 2516 wrote to memory of 2564	2516	rlyspool.exe	34
PID 2516 wrote to memory of 2564	2516	rlyspool.exe	34
PID 2516 wrote to memory of 2564	2516	rlyspool.exe	34
PID 2516 wrote to memory of 2564	2516	rlyspool.exe	34
PID 2564 wrote to memory of 1804	2564	rlyspool.exe	35
PID 2564 wrote to memory of 1804	2564	rlyspool.exe	35
PID 2564 wrote to memory of 1804	2564	rlyspool.exe	35
PID 2564 wrote to memory of 1804	2564	rlyspool.exe	35
PID 1804 wrote to memory of 1452	1804	rlyspool.exe	36
PID 1804 wrote to memory of 1452	1804	rlyspool.exe	36
PID 1804 wrote to memory of 1452	1804	rlyspool.exe	36
PID 1804 wrote to memory of 1452	1804	rlyspool.exe	36
PID 1452 wrote to memory of 1860	1452	rlyspool.exe	37
PID 1452 wrote to memory of 1860	1452	rlyspool.exe	37
PID 1452 wrote to memory of 1860	1452	rlyspool.exe	37
PID 1452 wrote to memory of 1860	1452	rlyspool.exe	37
PID 1860 wrote to memory of 2576	1860	rlyspool.exe	38
PID 1860 wrote to memory of 2576	1860	rlyspool.exe	38
PID 1860 wrote to memory of 2576	1860	rlyspool.exe	38
PID 1860 wrote to memory of 2576	1860	rlyspool.exe	38
PID 2576 wrote to memory of 1504	2576	rlyspool.exe	39
PID 2576 wrote to memory of 1504	2576	rlyspool.exe	39
PID 2576 wrote to memory of 1504	2576	rlyspool.exe	39
PID 2576 wrote to memory of 1504	2576	rlyspool.exe	39

C:\Users\Admin\AppData\Local\Temp\63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rlyspool.exe
  C:\Windows\system32\rlyspool.exe 472 "C:\Users\Admin\AppData\Local\Temp\63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\rlyspool.exe
    C:\Windows\system32\rlyspool.exe 528 "C:\Windows\SysWOW64\rlyspool.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\rlyspool.exe
      C:\Windows\system32\rlyspool.exe 536 "C:\Windows\SysWOW64\rlyspool.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 532 "C:\Windows\SysWOW64\rlyspool.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2516
      - C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 544 "C:\Windows\SysWOW64\rlyspool.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 540 "C:\Windows\SysWOW64\rlyspool.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 552 "C:\Windows\SysWOW64\rlyspool.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 548 "C:\Windows\SysWOW64\rlyspool.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 572 "C:\Windows\SysWOW64\rlyspool.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 556 "C:\Windows\SysWOW64\rlyspool.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\rlyspool.exe

Filesize
626KB

MD5
63023d98bdaea28a4089def821ea00d8

SHA1
a6fa02fb2fdbdc0f84f06d090c1f60f94f636b39

SHA256
84983c4c04ccf4d8a13967fecad7b0140ea38410e37a432735a898174641474a

SHA512
15e922cf1258bc52433a96d598d6229972749ae8e970aafd36d53448c3b58f93312e2d10345d12587d77ff850c70a10db5b93a271f10a74b1eb177a054ef68e0

Download Submit
memory/1452-43-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1504-57-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1804-38-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1804-44-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1860-53-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1860-48-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2000-12-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2000-19-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2448-18-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2448-24-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2516-34-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2516-28-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2564-33-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2564-39-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2576-52-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2576-58-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2644-29-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2644-23-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2988-0-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2988-14-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2988-10-0x0000000002760000-0x00000000027FF000-memory.dmp

Filesize
636KB

Download