67118bd39edf4136eea323c53d9381ffb2878c4d1fe875c8a969f820d07d79a6

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 14:06

Target

aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe
Size

5.8MB
MD5

aa164214ff5f6af2f4e28b6aa6d25e1b
SHA1

7da12991c2c96006baaaf6fd0fed7e3ee7aa91e0
SHA256

67118bd39edf4136eea323c53d9381ffb2878c4d1fe875c8a969f820d07d79a6
SHA512

b20f5aa114c8c972e7465de2c659fa30aabeb307806cc4517101a0f7b6ac7be9e4a33217f3b80c02b6f7d121f897deb3a97987eea6527e1e92d4b884dcce6490
SSDEEP

98304:NMp5EBCoIyyx2JJDNC/LyBC2/54F4AWUi91BiQzFuoUINnfK170otkKZkLScOFjT:NMpSBCoIbx27DNC+54Fhy1Lzopua70W+

Score

7^/10

vmprotect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2948-12-0x0000000140000000-0x0000000140AAE000-memory.dmp	vmprotect
behavioral2/memory/2948-19-0x0000000140000000-0x0000000140AAE000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2948	aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe
2948	aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe
2948	aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe
2948	aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa164214ff5f6af2f4e28b6aa6d25e1b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4020,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
1⤵
PID:3040

C:\AYE\config.ini

Filesize
100B

MD5
609971b218756104000dece3400e89a0

SHA1
9cb55afaf250542c24b3bdbab0e031a0ac6d1e9d

SHA256
b123a7946fc86362df6aef429cf7776aa749814a8d5d6218d503e0ee70e7b9c1

SHA512
11f5a4889b953c59e22b73261d832d1f99b1f0afb2058d041b0e7511e5db6e02a916007f728806d30e2830da8a81afd9aa8d37676789ce8d83d359e12ae1bce4

Download Submit
memory/2948-2-0x0000000140114000-0x00000001404D5000-memory.dmp

Filesize
3.8MB

Download
memory/2948-1-0x00007FF9AEF40000-0x00007FF9AEF42000-memory.dmp

Filesize
8KB

Download
memory/2948-0-0x00007FF9AEF30000-0x00007FF9AEF32000-memory.dmp

Filesize
8KB

Download
memory/2948-7-0x00007FF9AEF50000-0x00007FF9AEF52000-memory.dmp

Filesize
8KB

Download
memory/2948-4-0x00007FF9AD680000-0x00007FF9AD682000-memory.dmp

Filesize
8KB

Download
memory/2948-6-0x00007FF9AC960000-0x00007FF9AC962000-memory.dmp

Filesize
8KB

Download
memory/2948-5-0x00007FF9AC950000-0x00007FF9AC952000-memory.dmp

Filesize
8KB

Download
memory/2948-3-0x00007FF9AD670000-0x00007FF9AD672000-memory.dmp

Filesize
8KB

Download
memory/2948-12-0x0000000140000000-0x0000000140AAE000-memory.dmp

Filesize
10.7MB

Download
memory/2948-18-0x0000000140114000-0x00000001404D5000-memory.dmp

Filesize
3.8MB

Download
memory/2948-19-0x0000000140000000-0x0000000140AAE000-memory.dmp

Filesize
10.7MB

Download