f7539b60a4e7139d79961a8d99c041b58f01bc85a4428a610aeb3202e8cceb0c

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 03:04

Target

fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe
Size

1.1MB
MD5

fbca49644d922e9216b95cd77a9cf781
SHA1

f4f8a3af5d1703d66d2fd109cedfed72ad117df5
SHA256

f7539b60a4e7139d79961a8d99c041b58f01bc85a4428a610aeb3202e8cceb0c
SHA512

8625fa95252194a77c74b992d9f55d53f48303bdff5cc35148f0ef5d33cd63afc20cc38adf5f461a4d71ccc4e72e7a077fd237136fab322baa8dc673cb86e2e2
SSDEEP

24576:Qw1K0+ynsyD4P5Vl9G3UQV3XUXF0k0VNIEtG3u1lsGYvr7mPTspKRnHqvq:DK0+ByDIl9G3zXzk+uEtB/tGr7mLsYKS

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4400-0-0x0000000000400000-0x00000000005B4000-memory.dmp	upx
behavioral2/memory/4400-74-0x0000000000400000-0x00000000005B4000-memory.dmp	upx
behavioral2/memory/4400-99-0x0000000000400000-0x00000000005B4000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe

pid	process
4400	fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe
4400	fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe
4400	fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe
4400	fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbca49644d922e9216b95cd77a9cf781_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:3432

C:\Users\Admin\AppData\Local\Temp\e57adda.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57adfa.tmp
Filesize
1.6MB

MD5
5870ea0d6ba8dd6e2008466bdd00e0f4

SHA1
d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5

SHA256
5a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d

SHA512
0c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837

Download Submit
C:\Users\Admin\AppData\Local\Temp\e57ae0b.tmp
Filesize
137KB

MD5
f6b847a54cfb804a25b8842b45fd1d50

SHA1
bb22fef07ce1577c8a7fa057d8cf05502c013bfc

SHA256
5dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583

SHA512
dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a

Download Submit
memory/4400-0-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/4400-74-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/4400-99-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download