91b03b4c9fcdaa59301f4a845201f8fe495cdb7d9c0d84669b63a00b189f2641

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 13:59

Target

67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
Size

1.5MB
MD5

67da4b30f33e4da711fdcc4282132033
SHA1

c6898eb326529d23c749875e96638218b4c257f8
SHA256

91b03b4c9fcdaa59301f4a845201f8fe495cdb7d9c0d84669b63a00b189f2641
SHA512

7b86d94463edacc3aac119eda1d6ba7cb13f9a8c4f232bf2ba72cfa8fb161e114f4581160582466f6a28ae5a58fa469d10190e58bb77c9b52874d630ee6e7fe1
SSDEEP

24576:R0XPbjedYC9KM8Q4iuJ0DC/DBDLnABo+qbCbmJhviMj8TMkD9MKvt5H:R0XjQY4KM8Q4H+eSxaXiMNkD+KF

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4316	Server.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3596-0-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral2/memory/3596-1-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral2/files/0x000800000002346a-6.dat	upx
behavioral2/memory/4316-8-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral2/memory/4316-12-0x0000000000400000-0x0000000000752000-memory.dmp	upx
behavioral2/memory/3596-13-0x0000000000400000-0x0000000000752000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3596	67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
4316	Server.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 4048	4316	Server.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
312	4048	WerFault.exe	88

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4048	4316	Server.exe	88
PID 4316 wrote to memory of 4048	4316	Server.exe	88
PID 4316 wrote to memory of 4048	4316	Server.exe	88
PID 4316 wrote to memory of 4048	4316	Server.exe	88
PID 4316 wrote to memory of 4048	4316	Server.exe	88

C:\Users\Admin\AppData\Local\Temp\67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4048 -ip 4048
1⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
1.5MB

MD5
67da4b30f33e4da711fdcc4282132033

SHA1
c6898eb326529d23c749875e96638218b4c257f8

SHA256
91b03b4c9fcdaa59301f4a845201f8fe495cdb7d9c0d84669b63a00b189f2641

SHA512
7b86d94463edacc3aac119eda1d6ba7cb13f9a8c4f232bf2ba72cfa8fb161e114f4581160582466f6a28ae5a58fa469d10190e58bb77c9b52874d630ee6e7fe1

Download Submit
memory/3596-0-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/3596-1-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/3596-3-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/3596-13-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/4316-8-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download
memory/4316-10-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/4316-12-0x0000000000400000-0x0000000000752000-memory.dmp

Filesize
3.3MB

Download