98ca248a6e8f0213a4c2dd31c78773832cff4a8383cc26cf428b62222a79ec3d

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe
Size 398KB
Sample240407-hmbb4sfd2v
SHA256 98ca248a6e8f0213a4c2dd31c78773832cff4a8383cc26cf428b62222a79ec3d
MD5 e451535b3434b5d314f84b567fc26f64
SHA1 7b10e40ab5653117a3fef9743eb29c7199f1d738
SHA512 27421464c8bfb783e199aed9e7bd6dfcaf091a95500499cd465c0d40a27fa4df44518d3f95fd55113751fccfdfe66eaaf3535a7acfaf6063c1b247fd4e8ef27f
SSDEEP 6144:778VcnvuiIW3E4SFYycqJPjsw8Sm7yaGNLgu/Vh1SlAXfiMl7uUasA5q:778WvVNRry3BoSHdjX1SSP71PtSq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
332	5A07.tmp
1396	5A27.tmp

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/3068-0-0x0000000000400000-0x00000000004D3000-memory.dmp	vmprotect
behavioral2/memory/3068-1-0x0000000000400000-0x00000000004D3000-memory.dmp	vmprotect
behavioral2/memory/3068-14-0x0000000000400000-0x00000000004D3000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	1396	WerFault.exe	87

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 332	3068	e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe	86
PID 3068 wrote to memory of 332	3068	e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe	86
PID 3068 wrote to memory of 332	3068	e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe	86
PID 3068 wrote to memory of 1396	3068	e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe	87
PID 3068 wrote to memory of 1396	3068	e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe	87
PID 3068 wrote to memory of 1396	3068	e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e451535b3434b5d314f84b567fc26f64_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\5A07.tmp
  "C:\Users\Admin\AppData\Local\Temp\5A07.tmp"
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Users\Admin\AppData\Local\Temp\5A27.tmp
  "C:\Users\Admin\AppData\Local\Temp\5A27.tmp"
  2⤵
  - Executes dropped EXE
  PID:1396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 228
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1396 -ip 1396
1⤵
PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

5A07.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A07.tmp
Size 414KB
SHA256 e69a35e53a9b6994f6c536a1af0039d1329a6727a62ce7c99976e33a74568cdc
MD5 da844e83297a6aac1ba053ccdd24e487
SHA1 9e4bc43e14c95651aa5dd6f67e573952674dcdd0
SHA512 2ad1b35d4abaada7123a0cfc7370a197bfaa359c548d7b115e019284880cdc305e51e9a572ca4cfb2a0e67781c060b3b71fdf7d76c4876cc0f29e789f15fad2c
SSDEEP 6144:abArEHkoWQPwfqeJT/qR461Rnza8/brU9xLjjqZDSpa/nIexgsRNAWlvSc97:abdWQP+qeJjquYaI4veZUa/I9UN3BB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

5A27.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A27.tmp
Size 50KB
SHA256 9f6d3ca755ceb505d2e4c24dc875da97714d84a7a8e8755526b134310a17912e
MD5 39e3076f9c30d8096fef9b804b4ed69b
SHA1 588ffcd51f1515becbdd7eb0e9102c996f9b3414
SHA512 1599ac940516157ed0bb41d9d81a7c1f5cce1b7f7ca729776fac3ca3c0dcc4ca91a4aec620b0118500b8567fd5a80c613249d83cf9e9705111d13201d0b629ee
SSDEEP 1536:Ofoal6Zm6CMwAnJbd0d24m34rw7/lPXJZF:Owq6ZY0bqK/lPXJZF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/332-15-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/332-17-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/1396-16-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3068-0-0x0000000000400000-0x00000000004D3000-memory.dmp

Download

memory/3068-1-0x0000000000400000-0x00000000004D3000-memory.dmp

Download

memory/3068-14-0x0000000000400000-0x00000000004D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads