9f610d3b0755f6addf3859c99499d6fa5df4e1b5b6c96ae1727780c4be19cab6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 08:46

Target

490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
Size

37KB
MD5

490f16c4187bdbcb87cab7dc2e7e7a78
SHA1

0cb455c882d30b33aedf0d9ae1bba9893058e53a
SHA256

9f610d3b0755f6addf3859c99499d6fa5df4e1b5b6c96ae1727780c4be19cab6
SHA512

73d93cf595978631c5a718cc8d1e95a2777bee328b74c47456cdde50ad31fa859473adf07f9e07152848662b1faf14dd22ee66389c24f4367a978ee5cb75d0b5
SSDEEP

768:/NHdie4gwzYmnPZOx+fkXJOV23fKj8/0AeMl1KY2Crvw37:/nT4b8fx+8wV2voGeMeYn7

Score

7^/10

vmprotect

Deletes itself 1 IoCs

pid	Process
2856	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	ntlm.exe

Loads dropped DLL 2 IoCs

pid	Process
1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1824-0-0x0000000000400000-0x0000000000414000-memory.dmp	vmprotect
behavioral1/files/0x00080000000120ff-3.dat	vmprotect
behavioral1/memory/1824-11-0x0000000000400000-0x0000000000414000-memory.dmp	vmprotect

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntlm.exe	ntlm.exe
File created	C:\Windows\SysWOW64\ntlm.exe	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ntlm.exe	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2748	ntlm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2748	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2748	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2748	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2748	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2856	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	31
PID 1824 wrote to memory of 2856	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	31
PID 1824 wrote to memory of 2856	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	31
PID 1824 wrote to memory of 2856	1824	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	31
PID 2748 wrote to memory of 2880	2748	ntlm.exe	32
PID 2748 wrote to memory of 2880	2748	ntlm.exe	32
PID 2748 wrote to memory of 2880	2748	ntlm.exe	32
PID 2748 wrote to memory of 2880	2748	ntlm.exe	32

C:\Users\Admin\AppData\Local\Temp\490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\ntlm.exe
  "C:\Windows\system32\ntlm.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\ntlm.exe > nul
    3⤵
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\490F16~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2856

\Windows\SysWOW64\ntlm.exe

Filesize
37KB

MD5
490f16c4187bdbcb87cab7dc2e7e7a78

SHA1
0cb455c882d30b33aedf0d9ae1bba9893058e53a

SHA256
9f610d3b0755f6addf3859c99499d6fa5df4e1b5b6c96ae1727780c4be19cab6

SHA512
73d93cf595978631c5a718cc8d1e95a2777bee328b74c47456cdde50ad31fa859473adf07f9e07152848662b1faf14dd22ee66389c24f4367a978ee5cb75d0b5

Download Submit
memory/1824-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1824-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download