2deb2bbb43db812e1898b5747056f97e150dce178f962d897ad093155ce128ca

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 11:19

Target

675edc387cafc86b5313e6dcba5bdf6d_JaffaCakes118.exe
Size

120KB
MD5

675edc387cafc86b5313e6dcba5bdf6d
SHA1

ab989b6d8eaf9326205ec01a1d19d13674960b66
SHA256

2deb2bbb43db812e1898b5747056f97e150dce178f962d897ad093155ce128ca
SHA512

ac2b0917b2ca6191683217fe9bac613c85ebe4bc939c90e4a2e2febfe3c6999c619fb80ef5eabf77631dec0c88d268716251cbab52675756ae008618182745e4
SSDEEP

1536:m1NAUwtT6sFstwrbUaHdJmnouy8kyib04Ibxyg96sEUXiaVJmAJTQQqSQDrJTHVF:wgtTPFsw01outQCF0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4696-0-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/4696-4-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3276	4696	675edc387cafc86b5313e6dcba5bdf6d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 3276	4696	675edc387cafc86b5313e6dcba5bdf6d_JaffaCakes118.exe	85
PID 4696 wrote to memory of 3276	4696	675edc387cafc86b5313e6dcba5bdf6d_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\675edc387cafc86b5313e6dcba5bdf6d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\675edc387cafc86b5313e6dcba5bdf6d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B40E.tmp\Òþ²Ø×îÖÕÍê³É°æ.bat""
  2⤵
  PID:3276

C:\Users\Admin\AppData\Local\Temp\B40E.tmp\Òþ²Ø×îÖÕÍê³É°æ.bat

Filesize
4KB

MD5
ab0f11563c827fdbc9a8c609863eff17

SHA1
442249d19608f3b4da14bb47397caad4158cd4b2

SHA256
d9e606c6fdb89d93402e97613fdee6816114a6bd45ed15610e0fa43dd0583d61

SHA512
7033a13255b33720f1a090e7de24cb8aa0b3b6c70f477ab92953d990802bcda925e7fd310c9081491dcb7195d5692c4a0db3b98c3b6991a73fb2f0d1fa92563f

Download Submit
memory/4696-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4696-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download