978c2637fb361b776835855a6254ed204c2df098e28a2c995ce9235b0a119ecb

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 09:20

Target

29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe
Size

92KB
MD5

29e1fc1299fa422437bf95f8aa96aed0
SHA1

da6169abd5b34eccb1e5a4e863bc6b1ffd23313e
SHA256

978c2637fb361b776835855a6254ed204c2df098e28a2c995ce9235b0a119ecb
SHA512

9ba00a46c4cffc0d63cbc242a48bf4a1816f5f19c28da34f41cf7eaa8b77dfa9aa7698c2eafcf47140c502a797abf663f8c9cc2e49a08b37a3f06525550bf364
SSDEEP

1536:XBaLje/TDLsRH7tTbhuReyxHJMF6OtElCbEpqccTBGXh5fVWytKCOHJec7:Xl/TnsH6edNnIe1GXhrGCOpeA

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/2040-3-0x0000000000310000-0x0000000000355000-memory.dmp	upx
behavioral1/memory/2040-8-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28
PID 2040 wrote to memory of 2020	2040	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe"
  2⤵
  PID:2020

memory/2020-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2020-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-11-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2020-12-0x0000000000410000-0x0000000000477000-memory.dmp

Filesize
412KB

Download
memory/2040-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2040-3-0x0000000000310000-0x0000000000355000-memory.dmp

Filesize
276KB

Download
memory/2040-8-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download