447d222fda73171011e748cdc9660b6fcd9a2b29f6a669ff3a1755010545fa9a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 23:11

Target

b5adfc98e3d5ec74fdaecc2a2e2d9c52_JaffaCakes118.exe
Size

408KB
MD5

b5adfc98e3d5ec74fdaecc2a2e2d9c52
SHA1

1653275285f2c52fd67c8be1b013c87893e59d59
SHA256

447d222fda73171011e748cdc9660b6fcd9a2b29f6a669ff3a1755010545fa9a
SHA512

397436d724fd5be5e764278ad236c8ad0a1c60c408e23d6a4cdc1f77b0b96481742fefd5e27688b039a76688a9432dd2d072fa71a603c24b1d0d106296b05ab6
SSDEEP

6144:q5HrYNJ76q0dV4W9tvYTDVKvXeyUoWsBcUyTEYM:qZrY76TXYPVK/eyUFWcbDM

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral1/memory/2276-3-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral1/memory/2276-5-0x0000000000400000-0x0000000000501000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2276	b5adfc98e3d5ec74fdaecc2a2e2d9c52_JaffaCakes118.exe
2276	b5adfc98e3d5ec74fdaecc2a2e2d9c52_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b5adfc98e3d5ec74fdaecc2a2e2d9c52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5adfc98e3d5ec74fdaecc2a2e2d9c52_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2276

memory/2276-0-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2276-1-0x0000000000A00000-0x0000000000B01000-memory.dmp

Filesize
1.0MB

Download
memory/2276-2-0x0000000000A00000-0x0000000000B01000-memory.dmp

Filesize
1.0MB

Download
memory/2276-3-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/2276-5-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download