9f610d3b0755f6addf3859c99499d6fa5df4e1b5b6c96ae1727780c4be19cab6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 08:46

Target

490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
Size

37KB
MD5

490f16c4187bdbcb87cab7dc2e7e7a78
SHA1

0cb455c882d30b33aedf0d9ae1bba9893058e53a
SHA256

9f610d3b0755f6addf3859c99499d6fa5df4e1b5b6c96ae1727780c4be19cab6
SHA512

73d93cf595978631c5a718cc8d1e95a2777bee328b74c47456cdde50ad31fa859473adf07f9e07152848662b1faf14dd22ee66389c24f4367a978ee5cb75d0b5
SSDEEP

768:/NHdie4gwzYmnPZOx+fkXJOV23fKj8/0AeMl1KY2Crvw37:/nT4b8fx+8wV2voGeMeYn7

Score

7^/10

vmprotect

Executes dropped EXE 1 IoCs

pid	Process
2292	ntlm.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4748-0-0x0000000000400000-0x0000000000414000-memory.dmp	vmprotect
behavioral2/files/0x000f0000000233f6-4.dat	vmprotect
behavioral2/memory/4748-6-0x0000000000400000-0x0000000000414000-memory.dmp	vmprotect

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ntlm.exe	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntlm.exe	ntlm.exe
File created	C:\Windows\SysWOW64\ntlm.exe	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4748	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2292	ntlm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2292	4748	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	86
PID 4748 wrote to memory of 2292	4748	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	86
PID 4748 wrote to memory of 2292	4748	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	86
PID 4748 wrote to memory of 2036	4748	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	87
PID 4748 wrote to memory of 2036	4748	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	87
PID 4748 wrote to memory of 2036	4748	490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe	87
PID 2292 wrote to memory of 1892	2292	ntlm.exe	88
PID 2292 wrote to memory of 1892	2292	ntlm.exe	88
PID 2292 wrote to memory of 1892	2292	ntlm.exe	88

C:\Users\Admin\AppData\Local\Temp\490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\490f16c4187bdbcb87cab7dc2e7e7a78_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\ntlm.exe
  "C:\Windows\system32\ntlm.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\ntlm.exe > nul
    3⤵
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\490F16~1.EXE > nul
  2⤵
  PID:2036

C:\Windows\SysWOW64\ntlm.exe

Filesize
37KB

MD5
490f16c4187bdbcb87cab7dc2e7e7a78

SHA1
0cb455c882d30b33aedf0d9ae1bba9893058e53a

SHA256
9f610d3b0755f6addf3859c99499d6fa5df4e1b5b6c96ae1727780c4be19cab6

SHA512
73d93cf595978631c5a718cc8d1e95a2777bee328b74c47456cdde50ad31fa859473adf07f9e07152848662b1faf14dd22ee66389c24f4367a978ee5cb75d0b5

Download Submit
memory/4748-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4748-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download