6c47bebfc1a0cc53be82268de3c7c6781d89254e54421091d7fa2c26e9514b01

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:34

Target

63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe
Size

3.6MB
MD5

63a27870cb00b350dd865034b11222e4
SHA1

f9a3ba92b5cca0af7261900727ac9e23e6052eb7
SHA256

6c47bebfc1a0cc53be82268de3c7c6781d89254e54421091d7fa2c26e9514b01
SHA512

54226d8d57e9b2e323bc45ef195a01eee866b57c9fb17da088e47bffcd9adf4fa099cab34cbe4400ea0ebf3143637aa409346b8140b0be116cc23f5320c8d833
SSDEEP

98304:WqYStbqeQTwLinzGZWNDIIVRevoigYLF3b+S/6VfdH:zftbSnTNDy/LF3b0fx

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2372-0-0x0000000000400000-0x0000000000EEB000-memory.dmp	upx
behavioral1/memory/2372-1-0x0000000000400000-0x0000000000EEB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe

pid process

2372 63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe
2372 63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe

pid	process
2372	63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe
2372	63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63a27870cb00b350dd865034b11222e4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2372

memory/2372-0-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download
memory/2372-1-0x0000000000400000-0x0000000000EEB000-memory.dmp

Filesize
10.9MB

Download