7729c91c01271f5d702aee463c583060cce1c245a77aaa1a6f0007b6f839fd5b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 08:55

Target

5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe
Size

105KB
MD5

5fd3a176e156ad89526394394fedf1d5
SHA1

213687717138d1ed70c52e1b805da4311d3125b7
SHA256

7729c91c01271f5d702aee463c583060cce1c245a77aaa1a6f0007b6f839fd5b
SHA512

ecd24758466e4af6efc44330a84b43a59448316f51fa3ef56db9f040c2d03c65df3964cb92258cd68263ab3ac71949e004c9b82a64fa67d0f619b6034fb8169f
SSDEEP

3072:Ffa4O/HtNxFgT1igox1LWq6xLRKB5nPPXoXnoutxV:Z/ioTMgoxh76OBNAoSf

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/3032-1-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/3032-18-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe
2984	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 3032 wrote to memory of 2984	3032	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	30
PID 2984 wrote to memory of 1244	2984	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	21
PID 2984 wrote to memory of 1244	2984	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	21
PID 2984 wrote to memory of 1244	2984	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	21
PID 2984 wrote to memory of 1244	2984	5fd3a176e156ad89526394394fedf1d5_JaffaCakes118.exe	21

memory/1244-19-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1244-22-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2984-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-16-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3032-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3032-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3032-3-0x0000000000401000-0x0000000000407000-memory.dmp

Filesize
24KB

Download
memory/3032-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download