9af200aeb08fd3f2dcc1228d0ea6318507ac0cc6b376e9c40714855d91ddefce

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:04

Target

0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe
Size

106KB
MD5

0eb005a348692a8ce43695c721eeed0c
SHA1

4345f6b566a83fd44e2548f9edc2859a5e97902b
SHA256

9af200aeb08fd3f2dcc1228d0ea6318507ac0cc6b376e9c40714855d91ddefce
SHA512

9bd296754d979aaba5556a3f6c07df6be2852e2f25218dc6f2422e9afa2d5fada4a4db07e9bdb11b6c833b24bba6e9a04402261a7c00bd137487c2c3503362a9
SSDEEP

1536:/HqZQ1s/356TPD4DXHpbrCHE1+D15SI9ttN7Ap4UhAzWqgJ/mpCEfxMPAMMfyiYc:UQ1oJBrCHHDEztK9f2PI

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2392-4-0x0000000000400000-0x0000000001B5E000-memory.dmp	upx
behavioral1/memory/2392-7-0x0000000000400000-0x0000000001B5E000-memory.dmp	upx
behavioral1/memory/2392-10-0x0000000000400000-0x0000000001B5E000-memory.dmp	upx
behavioral1/memory/2392-11-0x0000000000400000-0x0000000001B5E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 2392	2888	0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2392	2888	0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2392	2888	0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2392	2888	0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2392	2888	0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2392	2888	0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2392	2888	0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0eb005a348692a8ce43695c721eeed0c_JaffaCakes118.exe
  2⤵
  PID:2392

memory/2392-4-0x0000000000400000-0x0000000001B5E000-memory.dmp

Filesize
23.4MB

Download
memory/2392-1-0x0000000000400000-0x0000000001B5E000-memory.dmp

Filesize
23.4MB

Download
memory/2392-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2392-7-0x0000000000400000-0x0000000001B5E000-memory.dmp

Filesize
23.4MB

Download
memory/2392-10-0x0000000000400000-0x0000000001B5E000-memory.dmp

Filesize
23.4MB

Download
memory/2392-11-0x0000000000400000-0x0000000001B5E000-memory.dmp

Filesize
23.4MB

Download
memory/2888-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2888-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download