b1352606d4aa5902b9284b1d03cdab3c03caceaa170c0dc8afd99e0ffe81e7c5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 02:50

Target

2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe
Size

639KB
MD5

2ab9c94338607b9908c7fa0a8e359545
SHA1

b21c53d47b9b219997f57d79f2343dc69a0d92ca
SHA256

b1352606d4aa5902b9284b1d03cdab3c03caceaa170c0dc8afd99e0ffe81e7c5
SHA512

a3c717bf231ae35277694764577af954bfb7428b0fe99f07028af61f467c5eb414ad45f61ef0318c53222a3a1eda3d522c8bead9ff8361b669b259bd18b51dcd
SSDEEP

12288:YCNO0VNmHzHV2aPHhUoS92Qj7tjbc+WmWtgk0Tv5ToZlTTHaUVRtr9:/Nvqzb5ajxjpWjGTuPr

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2828-10-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2828-8-0x0000000000400000-0x0000000000458000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2828	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe
Token: SeDebugPrivilege	2828	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2828	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2828	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2828	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2828	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2828	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2828	1620	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	30
PID 2828 wrote to memory of 2884	2828	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2884	2828	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2884	2828	2ab9c94338607b9908c7fa0a8e359545_JaffaCakes118.exe	31

memory/1620-0-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/1620-2-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/1620-3-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1620-4-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/1620-5-0x0000000002210000-0x000000000226E000-memory.dmp

Filesize
376KB

Download
memory/1620-6-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/1620-12-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2828-10-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2828-8-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2828-7-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2828-13-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2828-14-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2828-15-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2828-16-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2828-17-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download