1ec0fd752756fd768dd6367559fad3f5f26b530b34aa2101cb63107a53ff1cc4

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 22:53

Target

2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe
Size

435KB
MD5

2e1e93c796833518aa5fc734626c7a52
SHA1

7da737cd84dd7d53e540873a62538a43de7736de
SHA256

1ec0fd752756fd768dd6367559fad3f5f26b530b34aa2101cb63107a53ff1cc4
SHA512

1a53006d315bc17942dd5c499e126cb04e12964c928d8360f75dd59307253a5805a99769920f2bc488efab75ff9e732e2cc46a4dbf593b4b3cfa4aedbe26ef6d
SSDEEP

6144:oapkygIwAovnd6nrk9qU10+3i+Gu0LZbYplIpPobTZRwhKWeMsn6pg+tbes+:oapgVAvraJ0ae98lIu3Hw4WFb7hJ+

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1988	explorer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4368-2-0x00000000007A0000-0x0000000000826000-memory.dmp	upx
behavioral2/memory/4368-1-0x00000000007A0000-0x0000000000826000-memory.dmp	upx
behavioral2/memory/4368-5-0x00000000007A0000-0x0000000000826000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 1988	4368	2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe	85

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1988	4368	2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe	85
PID 4368 wrote to memory of 1988	4368	2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe	85
PID 4368 wrote to memory of 1988	4368	2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe	85
PID 4368 wrote to memory of 1988	4368	2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e1e93c796833518aa5fc734626c7a52_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:1988

memory/4368-0-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4368-2-0x00000000007A0000-0x0000000000826000-memory.dmp

Filesize
536KB

Download
memory/4368-1-0x00000000007A0000-0x0000000000826000-memory.dmp

Filesize
536KB

Download
memory/4368-4-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4368-5-0x00000000007A0000-0x0000000000826000-memory.dmp

Filesize
536KB

Download