9df8b79786539bfdcfa44a8c6137dbca617594709a74172df9e7059ec0385a82

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 02:41

Target

0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
Size

3.2MB
MD5

0432e85101b6628c72addae7d5c5aae9
SHA1

34bf4ea558a5d877a67b46a6427d5c85c7bb8ed3
SHA256

9df8b79786539bfdcfa44a8c6137dbca617594709a74172df9e7059ec0385a82
SHA512

407d855f907c874371e5aaf8cb80225d6c7d36ca01761803312b349ee9e3c4e321470f5bf4a6c21d0dcbae20953f82bcf60085264d7f2e6324eac37c88d26d90
SSDEEP

49152:Z1TEaP0I/iTLaOXhEdFsb2Z3wmU6dSklvy2ghOFBd:YG/icdFBw+628OZ

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x0000000000B90000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2172	2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2172	2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2172	2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2172	2240	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\Cmd.exe
  Cmd.exe /C "del "C:\Users\Admin\AppData\Local\Temp\*.dmp" /q /s"
  2⤵
  PID:2172

C:\Users\Admin\AppData\Local\Temp\Seting.ini

Filesize
27B

MD5
faf1a3745428b775ad716d882fd87716

SHA1
07e4c0a3f24e07822d9dec5de2259b9f3fbc04fd

SHA256
c501d64ac860bdc24c32fd436bb95fa86dde402b675ea0afee8cbdadade29b52

SHA512
4185622de280520026f1c4264f8906e4ee307531f2a64277dead1d4c0c0198d069cdb749118f1aaca31b1cd138f568249a975475d357e56a5d07ad96f6c6f200

Download Submit
memory/2240-0-0x0000000000400000-0x0000000000B90000-memory.dmp

Filesize
7.6MB

Download