978c2637fb361b776835855a6254ed204c2df098e28a2c995ce9235b0a119ecb

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 09:20

Target

29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe
Size

92KB
MD5

29e1fc1299fa422437bf95f8aa96aed0
SHA1

da6169abd5b34eccb1e5a4e863bc6b1ffd23313e
SHA256

978c2637fb361b776835855a6254ed204c2df098e28a2c995ce9235b0a119ecb
SHA512

9ba00a46c4cffc0d63cbc242a48bf4a1816f5f19c28da34f41cf7eaa8b77dfa9aa7698c2eafcf47140c502a797abf663f8c9cc2e49a08b37a3f06525550bf364
SSDEEP

1536:XBaLje/TDLsRH7tTbhuReyxHJMF6OtElCbEpqccTBGXh5fVWytKCOHJec7:Xl/TnsH6edNnIe1GXhrGCOpeA

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2524-0-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral2/memory/2524-9-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85
PID 2524 wrote to memory of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85
PID 2524 wrote to memory of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85
PID 2524 wrote to memory of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85
PID 2524 wrote to memory of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85
PID 2524 wrote to memory of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85
PID 2524 wrote to memory of 4028	2524	29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\29e1fc1299fa422437bf95f8aa96aed0_JaffaCakes118.exe"
  2⤵
  PID:4028

memory/2524-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2524-9-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4028-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4028-4-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4028-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4028-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4028-10-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download