17134aea0cd519a840c70036fc778e49a15deb0cd4b24f74561d851ef610d287

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 15:19

Target

30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe
Size

6.3MB
MD5

30e74530b4561ccf52ce18551bf0d593
SHA1

d993c699c46322fb238114247c6323b1dccc2566
SHA256

17134aea0cd519a840c70036fc778e49a15deb0cd4b24f74561d851ef610d287
SHA512

9f3db58b7a06669b1e83b6a85f131b91b46c21464ec32fee4ea9c8e851d8a2783bd5eb40b0b08175ed69386d155854db18cf3b6044988378dfa5cedbe77dfc3e
SSDEEP

98304:n6uErK1b246brsrxCD8GLs0h4duyv3DMz9bJMhC6uKriVR6V:nDErC/6/LD8I4rwz9bJMQ6br+6V

Score

7^/10

upx

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3012-0-0x0000000000400000-0x000000000152A000-memory.dmp	upx
behavioral2/memory/1896-3-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral2/memory/1896-6-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral2/memory/1896-8-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral2/memory/1896-7-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral2/memory/3012-10-0x0000000000400000-0x000000000152A000-memory.dmp	upx
behavioral2/memory/1896-11-0x0000000000400000-0x00000000006C4000-memory.dmp	upx
behavioral2/memory/1896-12-0x0000000000400000-0x00000000006C4000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85
PID 3012 wrote to memory of 1896	3012	30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\30e74530b4561ccf52ce18551bf0d593_JaffaCakes118.exe"
  2⤵
  PID:1896

memory/1896-3-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1896-6-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1896-8-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1896-7-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1896-11-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1896-12-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/3012-0-0x0000000000400000-0x000000000152A000-memory.dmp

Filesize
17.2MB

Download
memory/3012-10-0x0000000000400000-0x000000000152A000-memory.dmp

Filesize
17.2MB

Download