86d8c3b6ee423e0f18d9daec02d0c2b7de417b3a8eb8118fa7fe5e790eb8865a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 00:16

Target

59b13d3fd5b85fc602a85333ca57721e_JaffaCakes118.exe
Size

684KB
MD5

59b13d3fd5b85fc602a85333ca57721e
SHA1

c23fa8301bd0c524c9d86f50f98af106c0a50b7c
SHA256

86d8c3b6ee423e0f18d9daec02d0c2b7de417b3a8eb8118fa7fe5e790eb8865a
SHA512

6d7bb2aba740310b014537f0020e9704d552f426d30726e57970d758f16c051684c62d557474217e79088901ee0eef21bf58dc932357d635473f2b4c41f5887e
SSDEEP

12288:ZmA//BGbMzIHYiCbVA//KWkORS0JwC0tSq0j9jnkwNk9OC+TicqjeKb3WLT7Cf:ZmA//BQO4Y9CCWkJ0JwC0kqadfTPLT

Score

7^/10

vmprotect

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x0000000000620000-memory.dmp	vmprotect
behavioral2/memory/4928-2-0x0000000000400000-0x0000000000620000-memory.dmp	vmprotect
behavioral2/memory/4928-4-0x0000000000400000-0x0000000000620000-memory.dmp	vmprotect

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	59b13d3fd5b85fc602a85333ca57721e_JaffaCakes118.exe
4928	59b13d3fd5b85fc602a85333ca57721e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\59b13d3fd5b85fc602a85333ca57721e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59b13d3fd5b85fc602a85333ca57721e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4928

memory/4928-0-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/4928-1-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/4928-2-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download
memory/4928-4-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download