31db18a579aacce5af0fa3f9a539e08a58843d82b54ebc9416841f544689d817

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe
Size

6.0MB
MD5

3cd86189efbd280c1cef2e6b7bd1b4ea
SHA1

7fced15cf82909bd4c7dbc7298af4ac6f8790fd7
SHA256

31db18a579aacce5af0fa3f9a539e08a58843d82b54ebc9416841f544689d817
SHA512

c7f44eb16dbd69103f5ed306e54b04d77b082c3f8c8c72a0c164da3af82bd58cd23dbe4df10c4ac495413f97e3602a8a6607a92eb6c3c9c673a4c34bdb12d294
SSDEEP

98304:QlktN4zX0Y4lqW7oQI4JQyrnIuSMWVgkNaB0fF13Nkrle7r1oUhFEzhkimHRDzz+:okgXF4p7ot4Dk5gkNaWF2Yr1oxazK

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 23 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2052-45-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-48-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-51-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-54-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-55-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-53-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-52-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-50-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-46-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-44-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-56-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-57-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-58-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-59-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-60-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-61-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-62-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-63-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-64-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-65-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-67-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-66-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect
behavioral1/memory/2052-112-0x0000000000D30000-0x0000000001729000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2052	3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2052	3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe
2052	3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2052	3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cd86189efbd280c1cef2e6b7bd1b4ea_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000000D92000-0x0000000001131000-memory.dmp

Filesize
3.6MB

Download
memory/2052-1-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2052-3-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2052-5-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2052-6-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2052-8-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2052-10-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2052-13-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2052-31-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2052-30-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2052-28-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2052-25-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2052-23-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2052-20-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2052-18-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2052-15-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2052-40-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2052-38-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2052-45-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-48-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-51-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-54-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-55-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-53-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-52-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-50-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-46-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-44-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-36-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2052-35-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2052-33-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2052-56-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-57-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-58-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-59-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-60-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-61-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-62-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-63-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-64-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-65-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-67-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-66-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download
memory/2052-111-0x0000000000D92000-0x0000000001131000-memory.dmp

Filesize
3.6MB

Download
memory/2052-112-0x0000000000D30000-0x0000000001729000-memory.dmp

Filesize
10.0MB

Download