99f61f7e85fbbca8db3c620827d75cc5ff20f7b5787e411d25daf35a78fd3eb1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 12:04

Target

29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe
Size

89KB
MD5

29e31791046e6b236274ffe9466b622a
SHA1

4f0b60fd9d4b7d53e2a6afec7659d3269e50c361
SHA256

99f61f7e85fbbca8db3c620827d75cc5ff20f7b5787e411d25daf35a78fd3eb1
SHA512

b7b3ea4de2924e94820b636335301d30428ef74a2a6fef0c35e7c7ccfeb13afcd3bcfe6d961af7afa62376faffff3f76dcf7acf84e9542e9e6fe178881e10765
SSDEEP

1536:ujmEJEPod7HyesI4FeWqaTcXqpxk1vw4ayHRuSW1n13Y1m:ujmE9QI4Fefaxc1a7h1um

Score

7^/10

upx

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1528-5-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1528-1-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/1528-3-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/1528-6-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/1528-7-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/1528-8-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1528-10-0x0000000000400000-0x0000000002B10000-memory.dmp	upx
behavioral2/memory/1528-11-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1528-13-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1528-15-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1528-18-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1528-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1528-22-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87
PID 4644 wrote to memory of 1528	4644	29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\29e31791046e6b236274ffe9466b622a_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

memory/1528-7-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1528-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1528-22-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1528-1-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1528-3-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1528-6-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1528-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1528-10-0x0000000000400000-0x0000000002B10000-memory.dmp

Filesize
39.1MB

Download
memory/1528-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1528-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1528-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1528-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1528-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4644-0-0x0000000000930000-0x0000000000934000-memory.dmp

Filesize
16KB

Download
memory/4644-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download