1845695c705717cb22bb1e428a8530ce40bbecae14648110fb677a5cb87038ae

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 18:53

Target

3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
Size

48KB
MD5

3e7b1e9768fd134e2cac89cc49097f7a
SHA1

1a24e7a5b9354689f008edfba37e8ebddb7863ba
SHA256

1845695c705717cb22bb1e428a8530ce40bbecae14648110fb677a5cb87038ae
SHA512

f88b9118c4d67c4c1fe4ce08d37b72501757c50dc42e51e6e2cf87a9b88f06fc2fadec22062a9986b26e623c1619581e4e5e55dc28102022eec88dc713435c08
SSDEEP

1536:wTp7c12yyp6cCBtLry+ZhnnTd+MTkAKu78z:r12yVcgtLO+jB+

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/files/0x0008000000015f55-5.dat	vmprotect

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mshtml.dllnIFMJ	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dll.mod	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mshtml.dll.mod	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dll	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DllCache\mshtml.dllnIFMJ	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DllCache\mshtml.dll	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\nIFMJ.LOG	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
File created	C:\Windows\system\nIFMJ.LOG	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1996	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
1996	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2064	1996	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2064	1996	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2064	1996	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2064	1996	3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e7b1e9768fd134e2cac89cc49097f7a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 132
  2⤵
  - Program crash
  PID:2064

C:\Users\Admin\AppData\Local\Temp\nIFMJ.LOG

Filesize
58KB

MD5
3f02027bf76984e8970212bef03d8401

SHA1
c4bd5951c375b307064680b6d9f49e9373032787

SHA256
3733659bbaebbe6a3e69bdb4647e02fd62b16bd5a58a3a23cb285b1a6de0d8a8

SHA512
0400b75321a365e10cfac4b4d3257b2235d02484e5077dbb8389a68880e04e2c3d48ca2d34ccc3f5d3de53b19545854462facc993b2e9fa9229a637e8c4fcf20

Download Submit
memory/1996-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1996-12-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download