Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 14:06

General

  • Target

    aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe

  • Size

    5.8MB

  • MD5

    aa164214ff5f6af2f4e28b6aa6d25e1b

  • SHA1

    7da12991c2c96006baaaf6fd0fed7e3ee7aa91e0

  • SHA256

    67118bd39edf4136eea323c53d9381ffb2878c4d1fe875c8a969f820d07d79a6

  • SHA512

    b20f5aa114c8c972e7465de2c659fa30aabeb307806cc4517101a0f7b6ac7be9e4a33217f3b80c02b6f7d121f897deb3a97987eea6527e1e92d4b884dcce6490

  • SSDEEP

    98304:NMp5EBCoIyyx2JJDNC/LyBC2/54F4AWUi91BiQzFuoUINnfK170otkKZkLScOFjT:NMpSBCoIbx27DNC+54Fhy1Lzopua70W+

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2288

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\AYE\config.ini

          Filesize

          100B

          MD5

          609971b218756104000dece3400e89a0

          SHA1

          9cb55afaf250542c24b3bdbab0e031a0ac6d1e9d

          SHA256

          b123a7946fc86362df6aef429cf7776aa749814a8d5d6218d503e0ee70e7b9c1

          SHA512

          11f5a4889b953c59e22b73261d832d1f99b1f0afb2058d041b0e7511e5db6e02a916007f728806d30e2830da8a81afd9aa8d37676789ce8d83d359e12ae1bce4

        • memory/2288-20-0x0000000077640000-0x0000000077642000-memory.dmp

          Filesize

          8KB

        • memory/2288-15-0x0000000077630000-0x0000000077632000-memory.dmp

          Filesize

          8KB

        • memory/2288-5-0x0000000077620000-0x0000000077622000-memory.dmp

          Filesize

          8KB

        • memory/2288-4-0x00000000775F0000-0x00000000775F2000-memory.dmp

          Filesize

          8KB

        • memory/2288-2-0x00000000775F0000-0x00000000775F2000-memory.dmp

          Filesize

          8KB

        • memory/2288-0-0x00000000775F0000-0x00000000775F2000-memory.dmp

          Filesize

          8KB

        • memory/2288-10-0x0000000140114000-0x00000001404D5000-memory.dmp

          Filesize

          3.8MB

        • memory/2288-13-0x0000000077630000-0x0000000077632000-memory.dmp

          Filesize

          8KB

        • memory/2288-11-0x0000000077630000-0x0000000077632000-memory.dmp

          Filesize

          8KB

        • memory/2288-16-0x0000000077640000-0x0000000077642000-memory.dmp

          Filesize

          8KB

        • memory/2288-7-0x0000000077620000-0x0000000077622000-memory.dmp

          Filesize

          8KB

        • memory/2288-18-0x0000000077640000-0x0000000077642000-memory.dmp

          Filesize

          8KB

        • memory/2288-33-0x0000000077650000-0x0000000077652000-memory.dmp

          Filesize

          8KB

        • memory/2288-25-0x000007FEFEB20000-0x000007FEFEB22000-memory.dmp

          Filesize

          8KB

        • memory/2288-30-0x000007FEFEB30000-0x000007FEFEB32000-memory.dmp

          Filesize

          8KB

        • memory/2288-28-0x000007FEFEB30000-0x000007FEFEB32000-memory.dmp

          Filesize

          8KB

        • memory/2288-23-0x000007FEFEB20000-0x000007FEFEB22000-memory.dmp

          Filesize

          8KB

        • memory/2288-31-0x0000000077650000-0x0000000077652000-memory.dmp

          Filesize

          8KB

        • memory/2288-35-0x0000000077650000-0x0000000077652000-memory.dmp

          Filesize

          8KB

        • memory/2288-46-0x0000000140000000-0x0000000140AAE000-memory.dmp

          Filesize

          10.7MB

        • memory/2288-9-0x0000000077620000-0x0000000077622000-memory.dmp

          Filesize

          8KB

        • memory/2288-40-0x0000000140000000-0x0000000140AAE000-memory.dmp

          Filesize

          10.7MB

        • memory/2288-47-0x0000000140114000-0x00000001404D5000-memory.dmp

          Filesize

          3.8MB

        • memory/2288-48-0x0000000140000000-0x0000000140AAE000-memory.dmp

          Filesize

          10.7MB