6280d012404b29d6c45b0bfc3333b589c035d23fd6e77a48aea78c9ba5346fea

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 17:37

Target

0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe
Size

292KB
MD5

0848de5a0f155139dadb0202d272c547
SHA1

15908142cca08be46cd240a21668043c24275584
SHA256

6280d012404b29d6c45b0bfc3333b589c035d23fd6e77a48aea78c9ba5346fea
SHA512

ce923856c26f24a1cc03909609d9d2e91dc273cab8284406a728207da793b9ae194e4558b2de87f967aaf3791c99cc2f461dd233314e0062c6783f67df909616
SSDEEP

6144:Ve32ZGWsqgyjiH44k4QHd8/khRxlp3q8E8+QMYy2wjGtqLwzDCvIbLdbs2VN9Vwd:E32ZhsqgyjiY4klCIxlo8E8+QMY9Qm4d

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2164-0-0x0000000000400000-0x00000000006D2000-memory.dmp	vmprotect
behavioral1/memory/2164-3-0x0000000000400000-0x00000000006D2000-memory.dmp	vmprotect
behavioral1/memory/2164-4-0x0000000000400000-0x00000000006D2000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2164	0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1440	2164	0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe	28
PID 2164 wrote to memory of 1440	2164	0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe	28
PID 2164 wrote to memory of 1440	2164	0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe	28
PID 2164 wrote to memory of 1440	2164	0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0848de5a0f155139dadb0202d272c547_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del "C:\Users\Admin\Cookies" /Q, vbHide
  2⤵
  PID:1440

memory/2164-0-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/2164-3-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/2164-4-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download