c109c1e92ee89a2bdd9cbca85484e01b649b51322ffbf4d465a4a7afb8d253ee

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe
Size

76KB
MD5

25192b5e6916302cb886c7f89785c22d
SHA1

747f9f524faa64370a7107a7e33e0cdd63556f78
SHA256

c109c1e92ee89a2bdd9cbca85484e01b649b51322ffbf4d465a4a7afb8d253ee
SHA512

ab7f7b18b69f7f12a7efd6180e43615b285a13d604da7ffb4b0f815c55f6925d0d0940a6f8e4099c7e38dac22d63292e583c35e7718ba0112af1b97fad0787bf
SSDEEP

1536:TSLGb3Ba79ijEKQOP4UTplPDpz5YnDKRPUxJbiHxlpiprgDq/FlfhXlaTu+U6E:WLqBNLlrJC+ROJbMiJ6qiTu8

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2648-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\奱奔g䕕楨㍔敋扊晊氀㉔䭶潋㐳䅗d杰歨慤c牐洳桊獍V㝭摃搶偒㝷䍪㠱洱伀䘴歎欀睆匷㕒偤㑄挀䭆䨳U灲瑗㉖㕫套噷噔䄀挸坌㕘橣猀畳甴儀桖煶w煐噄Y瑒楒協G塯扭䩷䱌漀湡坐uㅰ慍畐潩䥴楧x漷䥒汃㡆奋椱愀癐偱灰畢䍋一来捫票瑐䍪坖	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe
File opened for modification	C:\Windows\㑏乆k䙫㝷剓搵䑐4䙣㍋啊爀坰噴欲圵睙呖V㡁䱣塗挵j獳㑵u噑癨睱倀䑱奖刀剴呩䝓漀浘睢䱊L慯偮畗瀀䴱偡極瑯杉硩㜀副䍉䙬䬸ㅙi偡煶灐扰䭵C敎歧档偹橴噃W	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe
File opened for modification	C:\Windows\塯扭䩷䱌漀湡坐uㅰ慍畐潩䥴楧x漷䥒汃㡆奋椱愀癐偱灰畢䍋一来捫票瑐䍪坖	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe
File opened for modification	C:\Windows\坌健䉈猵佑䴀汴游f湆器䅧G扄栶瑹睂氵瑌l㙓剧䅆O㡰欵杵㕰唀偗䑬㑗噯畴啌䍳瀀慪潹千奵猀煱㙓摔䰸乪㍊坌眀䱋䌲䱆洶潓坯剖Q摒瑬橳甀䍢汰䭌q䩷剌奍䍙䬀䵶䍵瑤䕃H夲削坰奍祋橍牔晉焀呙杙唀桅呩䬳䩥䩢f呬瘲䭋㍯圴摁瀀桧摫捡倀㍲䩭䵨噳洀䌷㙤剤睐樷ㅃㄸm㑏乆k䙫㝷剓搵䑐4䙣㍋啊爀坰噴欲圵睙呖V㡁䱣塗挵j獳㑵u噑癨睱倀䑱奖刀剴呩䝓漀浘睢䱊L慯偮畗瀀䴱偡極瑯杉硩㜀副䍉䙬䬸ㅙi偡煶灐扰䭵C敎歧档偹橴噃W	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2648	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2648	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe
2648	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2648	25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25192b5e6916302cb886c7f89785c22d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-7-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download