892348b0440f966e78cd1e06714e02edd84a4e0b36be3bbacfc2a261363d6956

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 02:53

Target

5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe
Size

750KB
MD5

5ec12b2c06ecb34ba23d450c38600d6e
SHA1

9c7e6783e30338081cb57a0bdb9e5986200ab4e4
SHA256

892348b0440f966e78cd1e06714e02edd84a4e0b36be3bbacfc2a261363d6956
SHA512

730c9259513a047f3be4f4a2818a351edf9d0fb9752b1d0c18597802a496b6cfc9ca6f9c0d2646d78804a5b20309c1c291977ee4e3a676eac5436232d306de1c
SSDEEP

3072:o887EJsA9dD9ovbcjSaNNdwXq7XXIThKrvLxJ0wht8NGqUhIQ+aJOJ0jqyArGiGM:fC31W5qSwwE

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2072-0-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral1/memory/2072-8-0x0000000000400000-0x00000000004BD000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2192	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe
2192	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2192	2072	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1204	2192	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	21
PID 2192 wrote to memory of 1204	2192	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	21
PID 2192 wrote to memory of 1204	2192	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	21
PID 2192 wrote to memory of 1204	2192	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	21

memory/1204-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1204-13-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2072-0-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2072-8-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2192-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2192-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2192-9-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download