892348b0440f966e78cd1e06714e02edd84a4e0b36be3bbacfc2a261363d6956

Analysis

max time kernel
139s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 02:53

Target

5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe
Size

750KB
MD5

5ec12b2c06ecb34ba23d450c38600d6e
SHA1

9c7e6783e30338081cb57a0bdb9e5986200ab4e4
SHA256

892348b0440f966e78cd1e06714e02edd84a4e0b36be3bbacfc2a261363d6956
SHA512

730c9259513a047f3be4f4a2818a351edf9d0fb9752b1d0c18597802a496b6cfc9ca6f9c0d2646d78804a5b20309c1c291977ee4e3a676eac5436232d306de1c
SSDEEP

3072:o887EJsA9dD9ovbcjSaNNdwXq7XXIThKrvLxJ0wht8NGqUhIQ+aJOJ0jqyArGiGM:fC31W5qSwwE

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/916-0-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral2/memory/916-8-0x0000000000400000-0x00000000004BD000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe
932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe
932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe
932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85
PID 916 wrote to memory of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85
PID 916 wrote to memory of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85
PID 916 wrote to memory of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85
PID 916 wrote to memory of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85
PID 916 wrote to memory of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85
PID 916 wrote to memory of 932	916	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	85
PID 932 wrote to memory of 3508	932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	56
PID 932 wrote to memory of 3508	932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	56
PID 932 wrote to memory of 3508	932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	56
PID 932 wrote to memory of 3508	932	5ec12b2c06ecb34ba23d450c38600d6e_JaffaCakes118.exe	56

memory/916-0-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/916-8-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/932-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/932-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/932-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/932-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3508-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3508-10-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download