3e5357eb3d4e15aafcdafb7b4615e1fa780f8748bedea09bc5c09092501ffec5

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 04:11

Target

21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe
Size

72KB
MD5

21090a3b61f5fc281f5a8dce8f0c922f
SHA1

a7def406a97651fb33d82f3ee1f23978ae8cf6aa
SHA256

3e5357eb3d4e15aafcdafb7b4615e1fa780f8748bedea09bc5c09092501ffec5
SHA512

4958bcb1134230dde18b163a0c024d772b445b1e1521f3dca49adce499db67e018809b710ec75d7b8b09bafd3b4784ecd3b5b437339f8afd6a219c568850de2e
SSDEEP

1536:onfEwIC2MpCVnsRBw5SjDYj70KmAa9WZl+30DNgTJpLeb/VgpOd:onfEwHlpCVnsRB6SHYHeAqWZ40UJcb/f

Score

7^/10

vmprotect

Deletes itself 1 IoCs

pid	Process
3012	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	fzsk.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1924-0-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral1/memory/1924-1-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral1/files/0x000b000000015bb9-4.dat	vmprotect
behavioral1/memory/2708-5-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral1/memory/1924-8-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral1/memory/2708-9-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fzsk.exe	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fzsk.exe	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1924	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3012	1924	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe	29
PID 1924 wrote to memory of 3012	1924	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe	29
PID 1924 wrote to memory of 3012	1924	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe	29
PID 1924 wrote to memory of 3012	1924	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\21090A~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3012

C:\Windows\SysWOW64\fzsk.exe
C:\Windows\SysWOW64\fzsk.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\SysWOW64\fzsk.exe

Filesize
72KB

MD5
21090a3b61f5fc281f5a8dce8f0c922f

SHA1
a7def406a97651fb33d82f3ee1f23978ae8cf6aa

SHA256
3e5357eb3d4e15aafcdafb7b4615e1fa780f8748bedea09bc5c09092501ffec5

SHA512
4958bcb1134230dde18b163a0c024d772b445b1e1521f3dca49adce499db67e018809b710ec75d7b8b09bafd3b4784ecd3b5b437339f8afd6a219c568850de2e

Download Submit
memory/1924-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1924-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1924-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2708-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2708-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download