6c876ee3f5df4d231b45606b762148c78a5fd325c218ffe08044eb33e9e6b563

Analysis

max time kernel
148s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 04:20

Target

661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
Size

136KB
MD5

661d78bb4c281c8b24c13d1878a703c8
SHA1

31310b4891bbf41d98b0cd6a52332459434241ed
SHA256

6c876ee3f5df4d231b45606b762148c78a5fd325c218ffe08044eb33e9e6b563
SHA512

da49ff6ef2b29e3b2cd935325b1edacff28f9286653f7744737a4eb53ea3aca289ce032bdfa6f09872db61d6da9bb663b9464a635089563a7f33271876bec26b
SSDEEP

3072:Ektoh5Bew+QMjv5bnz3cT+adE24rTfh4nc:EI2b4QMlb4T+H24vfL

Score

7^/10

vmprotect

Deletes itself 1 IoCs

pid	Process
2228	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2588	vifzsk.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/756-3-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect
behavioral1/memory/756-0-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect
behavioral1/files/0x000e000000012025-4.dat	vmprotect
behavioral1/memory/2588-5-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect
behavioral1/memory/2588-8-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vifzsk.exe	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\vifzsk.exe	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
756	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
2588	vifzsk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	756	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2228	756	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe	32
PID 756 wrote to memory of 2228	756	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe	32
PID 756 wrote to memory of 2228	756	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe	32
PID 756 wrote to memory of 2228	756	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\661D78~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2228

C:\Windows\SysWOW64\vifzsk.exe

Filesize
136KB

MD5
661d78bb4c281c8b24c13d1878a703c8

SHA1
31310b4891bbf41d98b0cd6a52332459434241ed

SHA256
6c876ee3f5df4d231b45606b762148c78a5fd325c218ffe08044eb33e9e6b563

SHA512
da49ff6ef2b29e3b2cd935325b1edacff28f9286653f7744737a4eb53ea3aca289ce032bdfa6f09872db61d6da9bb663b9464a635089563a7f33271876bec26b

Download Submit
memory/756-3-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/756-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2588-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2588-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download