ea9fad7fd6dbaebd73674549ced3393bb5b4efe27824b119f57fd33576da472c

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 14:22

Target

20ca83949323c0308f2edfa5ce22a669_JaffaCakes118.exe
Size

291KB
MD5

20ca83949323c0308f2edfa5ce22a669
SHA1

179ef1106ae1e213c2cfbaf89e6fdd2d3d5b5b9c
SHA256

ea9fad7fd6dbaebd73674549ced3393bb5b4efe27824b119f57fd33576da472c
SHA512

63f2c28e6421dc256df9ba27d913aba0ceb36aa22159e330ee09ba614521f3dea1c38edb0ad69e29cdd69e72b6b19d0f9ab06346b14cb48c11b1a5c1e4e8b72b
SSDEEP

6144:FRh6eY/I516uP0Pk5tZ9eRvwZQMRiyMkjeqmAUI+af5kvRhBmWhm6EDSX:2I16uP2k5pZQQMcmAUI+af5kJhBmWh

Score

10^/10

vmprotect

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2368-1-0x00000000001A0000-0x000000000020C000-memory.dmp	disable_win_def

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2368-1-0x00000000001A0000-0x000000000020C000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	20ca83949323c0308f2edfa5ce22a669_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3048	2368	20ca83949323c0308f2edfa5ce22a669_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3048	2368	20ca83949323c0308f2edfa5ce22a669_JaffaCakes118.exe	28
PID 2368 wrote to memory of 3048	2368	20ca83949323c0308f2edfa5ce22a669_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\20ca83949323c0308f2edfa5ce22a669_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20ca83949323c0308f2edfa5ce22a669_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 992
  2⤵
  PID:3048

memory/2368-0-0x000007FEF5593000-0x000007FEF5594000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x00000000001A0000-0x000000000020C000-memory.dmp

Filesize
432KB

Download
memory/2368-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2368-4-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download
memory/2368-5-0x000007FEF5593000-0x000007FEF5594000-memory.dmp

Filesize
4KB

Download
memory/2368-6-0x000007FEF5590000-0x000007FEF5F7C000-memory.dmp

Filesize
9.9MB

Download