6b3c1111c51f4757c0003ae7005b817add89511a9d34c058de58df602d4eda23

Analysis

max time kernel
87s
max time network
93s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 17:12

Target

60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe
Size

6KB
MD5

60b4f7a0df2597e0271ee963d7cb2963
SHA1

407e9a496ce602a424c97d557a6ca3b57dc42c5e
SHA256

6b3c1111c51f4757c0003ae7005b817add89511a9d34c058de58df602d4eda23
SHA512

28b454e78b5a4b11f05e7ea54d4316f67241358f15321c593e8476491cc6a7bcf09791d2cc0e8d0359bbaaa9debce3268ae0bf2143fcb2ea54cb0a413a3377c1
SSDEEP

96:TTC1/Za2vfu9Jod0ruNCyZdoO4MQOt6qjoL/zWLn2TU:PCNvfmqymVyMQOfcrzO

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2376	explorer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1292-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1292-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1292-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 2376	1292	60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe	31

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2376	1292	60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe	31
PID 1292 wrote to memory of 2376	1292	60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe	31
PID 1292 wrote to memory of 2376	1292	60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe	31
PID 1292 wrote to memory of 2376	1292	60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe	31
PID 1292 wrote to memory of 2376	1292	60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60b4f7a0df2597e0271ee963d7cb2963_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:2376

memory/1292-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1292-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1292-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download