6972f302970bc0160eb9ba2ae99c920e711279c4b0549b0ae75205992bf215db

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 23:27

Target

2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
Size

77KB
MD5

2c3c240fc01a87d7fa78a4918fe046e0
SHA1

a6f17088c6fdcdf0fdc27aa96cbc51d0c1ef6660
SHA256

6972f302970bc0160eb9ba2ae99c920e711279c4b0549b0ae75205992bf215db
SHA512

8f9e4af29a1f40103ed472a395ddc0963db91cdfe09f1d389646e30f7411c637e94239f449f92cb5f4cdad3f2f89c84090ec15b7e446750c268b42f6d0b564a3
SSDEEP

1536:qJ/J/ab9jsNyEXwjpHQ1E8yvCBlWUXxlO50uus:y/MjsdwjpHn96BQUXxE50ps

Score

7^/10

upx

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2060-4-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2060-1-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2060-3-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2060-7-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2060-6-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2060-8-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2060-10-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/2060-11-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2060-13-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2060-15-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2060-17-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2060-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2060-22-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
2060	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84
PID 1260 wrote to memory of 2060	1260	2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2c3c240fc01a87d7fa78a4918fe046e0_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060

memory/1260-0-0x0000000000A60000-0x0000000000A64000-memory.dmp

Filesize
16KB

Download
memory/2060-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2060-1-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2060-3-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2060-7-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2060-6-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2060-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2060-10-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/2060-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2060-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2060-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2060-17-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2060-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2060-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download