Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 11:39

General

  • Target

    11debc4ad6b9d84f30913abbc434f376_JaffaCakes118.exe

  • Size

    716KB

  • MD5

    11debc4ad6b9d84f30913abbc434f376

  • SHA1

    3932404c5803cc1de28e22c985bcb9e16f657ead

  • SHA256

    596e15823876ad3c290d491e054b14df5bc83cd6ebe8e64d8f7e778b35b224da

  • SHA512

    57dbbac91811f75770ad28f3ddb4370a20c22bbd493f034a940c706b190457cbb2e3507b1127d283c0a95b73fac1d9471e16e7ae91d6f7aa408620c34f06fa3c

  • SSDEEP

    12288:afWs4B9RwTqv8ZVETOur6vXKeF76nHrUooyCY+F2keIpDQ481SDkLZ31A:a4tW0Oumv6eFYUooPzNpziSDkp

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11debc4ad6b9d84f30913abbc434f376_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\11debc4ad6b9d84f30913abbc434f376_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2324-0-0x0000000000400000-0x00000000005E9000-memory.dmp

    Filesize

    1.9MB

  • memory/2324-2-0x0000000000400000-0x00000000005E9000-memory.dmp

    Filesize

    1.9MB

  • memory/2324-5-0x0000000000400000-0x00000000005E9000-memory.dmp

    Filesize

    1.9MB