9df8b79786539bfdcfa44a8c6137dbca617594709a74172df9e7059ec0385a82

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 02:41

Target

0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
Size

3.2MB
MD5

0432e85101b6628c72addae7d5c5aae9
SHA1

34bf4ea558a5d877a67b46a6427d5c85c7bb8ed3
SHA256

9df8b79786539bfdcfa44a8c6137dbca617594709a74172df9e7059ec0385a82
SHA512

407d855f907c874371e5aaf8cb80225d6c7d36ca01761803312b349ee9e3c4e321470f5bf4a6c21d0dcbae20953f82bcf60085264d7f2e6324eac37c88d26d90
SSDEEP

49152:Z1TEaP0I/iTLaOXhEdFsb2Z3wmU6dSklvy2ghOFBd:YG/icdFBw+628OZ

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/432-0-0x0000000000400000-0x0000000000B90000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3084	432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe	87
PID 432 wrote to memory of 3084	432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe	87
PID 432 wrote to memory of 3084	432	0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0432e85101b6628c72addae7d5c5aae9_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\Cmd.exe
  Cmd.exe /C "del "C:\Users\Admin\AppData\Local\Temp\*.dmp" /q /s"
  2⤵
  PID:3084

C:\Users\Admin\AppData\Local\Temp\Seting.ini

Filesize
35B

MD5
075237c3217de24ca273f46b7047880c

SHA1
082f08eda495ae7aa9b8960e8c696904c9f4e828

SHA256
94429886a273faf9af63ea18bf1cad84c74556558aafc78d6c310e50cb8b6f1a

SHA512
59136bc09f2e61e64df62029e1e086f1cf1d6399befdb909007b8a9a2a605ce455cccec512e9689f1f77cb2f4897b12a9577ca38e07b21d1a41d7ca453b5c839

Download Submit
memory/432-0-0x0000000000400000-0x0000000000B90000-memory.dmp

Filesize
7.6MB

Download