91b03b4c9fcdaa59301f4a845201f8fe495cdb7d9c0d84669b63a00b189f2641

Analysis

max time kernel
31s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 13:59

Target

67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
Size

1.5MB
MD5

67da4b30f33e4da711fdcc4282132033
SHA1

c6898eb326529d23c749875e96638218b4c257f8
SHA256

91b03b4c9fcdaa59301f4a845201f8fe495cdb7d9c0d84669b63a00b189f2641
SHA512

7b86d94463edacc3aac119eda1d6ba7cb13f9a8c4f232bf2ba72cfa8fb161e114f4581160582466f6a28ae5a58fa469d10190e58bb77c9b52874d630ee6e7fe1
SSDEEP

24576:R0XPbjedYC9KM8Q4iuJ0DC/DBDLnABo+qbCbmJhviMj8TMkD9MKvt5H:R0XjQY4KM8Q4H+eSxaXiMNkD+KF

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2176	Server.exe

Loads dropped DLL 2 IoCs

pid	Process
2760	WerFault.exe
2760	WerFault.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2864-0-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral1/memory/2864-1-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral1/files/0x00090000000120f1-6.dat	upx
behavioral1/memory/2176-7-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral1/memory/2176-8-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral1/memory/2864-13-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral1/memory/2176-14-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral1/memory/2864-15-0x0000000000400000-0x0000000000752000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2864	67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
2176	Server.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2176	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2760	2176	Server.exe	31
PID 2176 wrote to memory of 2760	2176	Server.exe	31
PID 2176 wrote to memory of 2760	2176	Server.exe	31
PID 2176 wrote to memory of 2760	2176	Server.exe	31

C:\Users\Admin\AppData\Local\Temp\67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2864

C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
1.5MB

MD5
67da4b30f33e4da711fdcc4282132033

SHA1
c6898eb326529d23c749875e96638218b4c257f8

SHA256
91b03b4c9fcdaa59301f4a845201f8fe495cdb7d9c0d84669b63a00b189f2641

SHA512
7b86d94463edacc3aac119eda1d6ba7cb13f9a8c4f232bf2ba72cfa8fb161e114f4581160582466f6a28ae5a58fa469d10190e58bb77c9b52874d630ee6e7fe1

Download Submit
memory/2176-7-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/2176-8-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/2176-10-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2176-14-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/2864-0-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/2864-1-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/2864-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2864-13-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/2864-15-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download