38978282659499297e4b9a5f42c2e1a87747528fa1f9bef9d7fc77c5129873f4

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 12:36

Target

2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe
Size

312KB
MD5

2c5f071287e96989e51028a7c128bea5
SHA1

7d598f3dab90e4c26be0bcca9c2947bf8cc95200
SHA256

38978282659499297e4b9a5f42c2e1a87747528fa1f9bef9d7fc77c5129873f4
SHA512

7d6576c7a4ebb415efed56ba7b5d9459160758db1cc81336efcef24581eb69930833aae072ce4530e953011ab9ca50af1aa9d30374c2e0c77f21c77aacebc877
SSDEEP

6144:zRahLyi2ZB797TXiwoACUh9Ai5kCsUveLMFZSabl1Vw:zR6yi23x7rCsnA87sUvJZHbv

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1304-0-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/1304-6-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 2344	1304	2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe	30

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2344	1304	2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2344	1304	2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2344	1304	2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2344	1304	2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2344	1304	2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c5f071287e96989e51028a7c128bea5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\system32\notepad.exe
  2⤵
  PID:2344

memory/1304-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1304-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1304-6-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2344-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download