6c876ee3f5df4d231b45606b762148c78a5fd325c218ffe08044eb33e9e6b563

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 04:20

Target

661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
Size

136KB
MD5

661d78bb4c281c8b24c13d1878a703c8
SHA1

31310b4891bbf41d98b0cd6a52332459434241ed
SHA256

6c876ee3f5df4d231b45606b762148c78a5fd325c218ffe08044eb33e9e6b563
SHA512

da49ff6ef2b29e3b2cd935325b1edacff28f9286653f7744737a4eb53ea3aca289ce032bdfa6f09872db61d6da9bb663b9464a635089563a7f33271876bec26b
SSDEEP

3072:Ektoh5Bew+QMjv5bnz3cT+adE24rTfh4nc:EI2b4QMlb4T+H24vfL

Score

7^/10

vmprotect

Executes dropped EXE 1 IoCs

pid	Process
3856	meouau.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2500-0-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect
behavioral2/memory/2500-1-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect
behavioral2/files/0x0009000000023426-5.dat	vmprotect
behavioral2/memory/3856-7-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect
behavioral2/memory/2500-9-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect
behavioral2/memory/3856-10-0x0000000000400000-0x000000000042E000-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\meouau.exe	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\meouau.exe	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2500	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
3856	meouau.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2500	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4784	2500	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe	85
PID 2500 wrote to memory of 4784	2500	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe	85
PID 2500 wrote to memory of 4784	2500	661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\661d78bb4c281c8b24c13d1878a703c8_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\661D78~1.EXE > nul
  2⤵
  PID:4784

C:\Windows\SysWOW64\meouau.exe

Filesize
136KB

MD5
661d78bb4c281c8b24c13d1878a703c8

SHA1
31310b4891bbf41d98b0cd6a52332459434241ed

SHA256
6c876ee3f5df4d231b45606b762148c78a5fd325c218ffe08044eb33e9e6b563

SHA512
da49ff6ef2b29e3b2cd935325b1edacff28f9286653f7744737a4eb53ea3aca289ce032bdfa6f09872db61d6da9bb663b9464a635089563a7f33271876bec26b

Download Submit
memory/2500-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2500-1-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2500-3-0x0000000000417000-0x0000000000418000-memory.dmp

Filesize
4KB

Download
memory/2500-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3856-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3856-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download