17134aea0cd519a840c70036fc778e49a15deb0cd4b24f74561d851ef610d287

Analysis

max time kernel
143s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 15:19

Target

30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe
Size

6.3MB
MD5

30e74530b4561ccf52ce18551bf0d593
SHA1

d993c699c46322fb238114247c6323b1dccc2566
SHA256

17134aea0cd519a840c70036fc778e49a15deb0cd4b24f74561d851ef610d287
SHA512

9f3db58b7a06669b1e83b6a85f131b91b46c21464ec32fee4ea9c8e851d8a2783bd5eb40b0b08175ed69386d155854db18cf3b6044988378dfa5cedbe77dfc3e
SSDEEP

98304:n6uErK1b246brsrxCD8GLs0h4duyv3DMz9bJMhC6uKriVR6V:nDErC/6/LD8I4rwz9bJMQ6br+6V

Score

7^/10

upx

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000400000-0x000000000152A000-memory.dmp	upx
behavioral1/memory/1496-3-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral1/memory/1496-5-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral1/memory/1496-8-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral1/memory/2296-6-0x0000000000400000-0x000000000152A000-memory.dmp	upx
behavioral1/memory/1496-7-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral1/memory/1496-9-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral1/memory/1496-10-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral1/memory/2296-11-0x0000000000400000-0x000000000152A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30
PID 2296 wrote to memory of 1496	2296	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe"
  2⤵
  PID:1496

memory/1496-3-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1496-5-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1496-8-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1496-7-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1496-9-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1496-10-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/2296-0-0x0000000000400000-0x000000000152A000-memory.dmp

Filesize
17.2MB

Download
memory/2296-6-0x0000000000400000-0x000000000152A000-memory.dmp

Filesize
17.2MB

Download
memory/2296-11-0x0000000000400000-0x000000000152A000-memory.dmp

Filesize
17.2MB

Download