089fce7d2d36da6bb8ce69d7e458c055f27915fbd5a27b5e1f3d2eb549aa942e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 07:24

Target

072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe
Size

420KB
MD5

072b9a8e149c304ec2ed28bc33cef462
SHA1

da7aa5df40e170415d75dd4025377352e3d47eab
SHA256

089fce7d2d36da6bb8ce69d7e458c055f27915fbd5a27b5e1f3d2eb549aa942e
SHA512

96e6f389b538e40f79cff3d9791d77aea1c8f521caa43e5c8c6e62e1ca78c162324e50a54a5854c512153786865f4a3b8be884e9ebf5650e95da55de4a234dde
SSDEEP

6144:G5euu9ZKRQz2EWeWkVjjZ849Ddtjn3nhrFdNYWwl3VkRR2AxQVvlmfKWQXQ:GYWRFE5849DdRn3nhJdN3w6DuFlmilQ

Score

7^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2264-11-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral1/memory/2264-14-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral1/memory/2264-7-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral1/memory/2264-12-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral1/memory/2264-5-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral1/memory/2264-3-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral1/memory/2264-17-0x0000000000400000-0x00000000004BD000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2960 set thread context of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2264	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28
PID 2960 wrote to memory of 2264	2960	072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\072b9a8e149c304ec2ed28bc33cef462_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2264

memory/2264-1-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2264-11-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2264-14-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2264-7-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2264-12-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2264-5-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2264-3-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2264-17-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2960-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2960-9-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download