17f614ad4b468da4f55b32b1d90f0a992ed30d19f388ee9998281eb44cb6b996

Analysis

max time kernel
140s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 08:11

Target

3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe
Size

157KB
MD5

3c9c059d3d1ad5b823e92d9a1beafc2f
SHA1

6cab1fd626ef500ba058463f03274e11975f0b20
SHA256

17f614ad4b468da4f55b32b1d90f0a992ed30d19f388ee9998281eb44cb6b996
SHA512

94aa8cb5e28f7733a39fe1b732bc7247ebca84204c5380ea30971b7048c11b9f3951c12f9591fda799394f6de5428c19c99c0b0ef91d74835cddc85e23fe87b4
SSDEEP

3072:XkmqMrCl9Q6KwTmGKdAgC8X92Y1YfytltV5LZI5XIgQN5OadBH+YSemXNQNsu3X:uMGnnmhXC8tfAeZ5LZ6IgsOEeYSegajH

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2244-3-0x0000000000240000-0x0000000000249000-memory.dmp	upx
behavioral1/memory/2244-20-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	980	WerFault.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 2244 wrote to memory of 980	2244	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	29
PID 980 wrote to memory of 976	980	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	30
PID 980 wrote to memory of 976	980	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	30
PID 980 wrote to memory of 976	980	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	30
PID 980 wrote to memory of 976	980	3c9c059d3d1ad5b823e92d9a1beafc2f_JaffaCakes118.exe	30

memory/980-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/980-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-24-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/980-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2244-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2244-3-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/2244-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download