3e5357eb3d4e15aafcdafb7b4615e1fa780f8748bedea09bc5c09092501ffec5

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:11

Target

21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe
Size

72KB
MD5

21090a3b61f5fc281f5a8dce8f0c922f
SHA1

a7def406a97651fb33d82f3ee1f23978ae8cf6aa
SHA256

3e5357eb3d4e15aafcdafb7b4615e1fa780f8748bedea09bc5c09092501ffec5
SHA512

4958bcb1134230dde18b163a0c024d772b445b1e1521f3dca49adce499db67e018809b710ec75d7b8b09bafd3b4784ecd3b5b437339f8afd6a219c568850de2e
SSDEEP

1536:onfEwIC2MpCVnsRBw5SjDYj70KmAa9WZl+30DNgTJpLeb/VgpOd:onfEwHlpCVnsRB6SHYHeAqWZ40UJcb/f

Score

7^/10

vmprotect

Executes dropped EXE 1 IoCs

pid	Process
1840	uyyg.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3536-0-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral2/memory/3536-1-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral2/files/0x000600000002326f-4.dat	vmprotect
behavioral2/memory/3536-8-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect
behavioral2/memory/1840-9-0x0000000000400000-0x0000000000428000-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\uyyg.exe	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uyyg.exe	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3536	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 1192	3536	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe	83
PID 3536 wrote to memory of 1192	3536	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe	83
PID 3536 wrote to memory of 1192	3536	21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21090a3b61f5fc281f5a8dce8f0c922f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\21090A~1.EXE > nul
  2⤵
  PID:1192

C:\Windows\SysWOW64\uyyg.exe
C:\Windows\SysWOW64\uyyg.exe
1⤵
- Executes dropped EXE
PID:1840

C:\Windows\SysWOW64\uyyg.exe

Filesize
72KB

MD5
21090a3b61f5fc281f5a8dce8f0c922f

SHA1
a7def406a97651fb33d82f3ee1f23978ae8cf6aa

SHA256
3e5357eb3d4e15aafcdafb7b4615e1fa780f8748bedea09bc5c09092501ffec5

SHA512
4958bcb1134230dde18b163a0c024d772b445b1e1521f3dca49adce499db67e018809b710ec75d7b8b09bafd3b4784ecd3b5b437339f8afd6a219c568850de2e

Download Submit
memory/1840-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3536-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3536-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3536-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download