84983c4c04ccf4d8a13967fecad7b0140ea38410e37a432735a898174641474a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
Size

626KB
MD5

63023d98bdaea28a4089def821ea00d8
SHA1

a6fa02fb2fdbdc0f84f06d090c1f60f94f636b39
SHA256

84983c4c04ccf4d8a13967fecad7b0140ea38410e37a432735a898174641474a
SHA512

15e922cf1258bc52433a96d598d6229972749ae8e970aafd36d53448c3b58f93312e2d10345d12587d77ff850c70a10db5b93a271f10a74b1eb177a054ef68e0
SSDEEP

6144:XkAREGVT8PEZoTPFgBw6t9RJIH97g03S16IaMJYFHc0MKXn:X/NVTCESTPqBw6nIHxJrK3W

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5012	rlyspool.exe
3316	rlyspool.exe
1800	rlyspool.exe
640	rlyspool.exe
3084	rlyspool.exe
2976	rlyspool.exe
1496	rlyspool.exe
1768	rlyspool.exe
4756	rlyspool.exe
4536	rlyspool.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1348-0-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/files/0x0009000000023430-5.dat	upx
behavioral2/memory/1348-7-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/3316-9-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/5012-10-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/3316-12-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/1800-14-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/640-16-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2976-18-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/3084-19-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/1496-21-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/2976-22-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/1496-24-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/1768-26-0x0000000000400000-0x000000000049F000-memory.dmp	upx
behavioral2/memory/4756-28-0x0000000000400000-0x000000000049F000-memory.dmp	upx

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File created	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe
File opened for modification	C:\Windows\SysWOW64\rlyspool.exe	rlyspool.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 5012	1348	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe	84
PID 1348 wrote to memory of 5012	1348	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe	84
PID 1348 wrote to memory of 5012	1348	63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe	84
PID 5012 wrote to memory of 3316	5012	rlyspool.exe	96
PID 5012 wrote to memory of 3316	5012	rlyspool.exe	96
PID 5012 wrote to memory of 3316	5012	rlyspool.exe	96
PID 3316 wrote to memory of 1800	3316	rlyspool.exe	99
PID 3316 wrote to memory of 1800	3316	rlyspool.exe	99
PID 3316 wrote to memory of 1800	3316	rlyspool.exe	99
PID 1800 wrote to memory of 640	1800	rlyspool.exe	101
PID 1800 wrote to memory of 640	1800	rlyspool.exe	101
PID 1800 wrote to memory of 640	1800	rlyspool.exe	101
PID 640 wrote to memory of 3084	640	rlyspool.exe	102
PID 640 wrote to memory of 3084	640	rlyspool.exe	102
PID 640 wrote to memory of 3084	640	rlyspool.exe	102
PID 3084 wrote to memory of 2976	3084	rlyspool.exe	104
PID 3084 wrote to memory of 2976	3084	rlyspool.exe	104
PID 3084 wrote to memory of 2976	3084	rlyspool.exe	104
PID 2976 wrote to memory of 1496	2976	rlyspool.exe	105
PID 2976 wrote to memory of 1496	2976	rlyspool.exe	105
PID 2976 wrote to memory of 1496	2976	rlyspool.exe	105
PID 1496 wrote to memory of 1768	1496	rlyspool.exe	113
PID 1496 wrote to memory of 1768	1496	rlyspool.exe	113
PID 1496 wrote to memory of 1768	1496	rlyspool.exe	113
PID 1768 wrote to memory of 4756	1768	rlyspool.exe	114
PID 1768 wrote to memory of 4756	1768	rlyspool.exe	114
PID 1768 wrote to memory of 4756	1768	rlyspool.exe	114
PID 4756 wrote to memory of 4536	4756	rlyspool.exe	118
PID 4756 wrote to memory of 4536	4756	rlyspool.exe	118
PID 4756 wrote to memory of 4536	4756	rlyspool.exe	118

C:\Users\Admin\AppData\Local\Temp\63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rlyspool.exe
  C:\Windows\system32\rlyspool.exe 1188 "C:\Users\Admin\AppData\Local\Temp\63023d98bdaea28a4089def821ea00d8_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\rlyspool.exe
    C:\Windows\system32\rlyspool.exe 1148 "C:\Windows\SysWOW64\rlyspool.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\SysWOW64\rlyspool.exe
      C:\Windows\system32\rlyspool.exe 1120 "C:\Windows\SysWOW64\rlyspool.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1800
    - - C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 1124 "C:\Windows\SysWOW64\rlyspool.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:640
      - C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 1136 "C:\Windows\SysWOW64\rlyspool.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 1092 "C:\Windows\SysWOW64\rlyspool.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 1132 "C:\Windows\SysWOW64\rlyspool.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 1140 "C:\Windows\SysWOW64\rlyspool.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 1144 "C:\Windows\SysWOW64\rlyspool.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\rlyspool.exe
        
        C:\Windows\system32\rlyspool.exe 1160 "C:\Windows\SysWOW64\rlyspool.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rlyspool.exe

Filesize
626KB

MD5
63023d98bdaea28a4089def821ea00d8

SHA1
a6fa02fb2fdbdc0f84f06d090c1f60f94f636b39

SHA256
84983c4c04ccf4d8a13967fecad7b0140ea38410e37a432735a898174641474a

SHA512
15e922cf1258bc52433a96d598d6229972749ae8e970aafd36d53448c3b58f93312e2d10345d12587d77ff850c70a10db5b93a271f10a74b1eb177a054ef68e0

Download Submit
memory/640-16-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1348-7-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1348-0-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1496-21-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1496-24-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1768-26-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1800-14-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2976-22-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2976-18-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3084-19-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3316-12-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3316-9-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/4756-28-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/5012-10-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download