5e039bf28bdff9b52bce291fd9830125da60d768497254de26bc864b37c29859

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe
Size

236KB
MD5

1bbe827187c2a8623bcc490953e45ad7
SHA1

0e573433b6eb2f4877b066fd8919d85ca2b1c36d
SHA256

5e039bf28bdff9b52bce291fd9830125da60d768497254de26bc864b37c29859
SHA512

3625f4769f25fb6cd2f11c40f10de7e3d562b3a3f7772668aff01be8f2ec7bb3a0be7e0bdcb25f664c35e4dfcd9fbd722eb0d7354607d45fe2f807e4bbd8b019
SSDEEP

6144:Y96AQGrE9DcQ0i8RfiyG68Sn68KijOkqX6Fbq2TzjDICh:YoAxrE9DcQ6qy38STjO36tjHIC

Score

8^/10

evasion trojan vmprotect

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe
File created	C:\Windows\system32\drivers\etc\hosts	1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2148-0-0x0000000000400000-0x000000000047D000-memory.dmp	vmprotect
behavioral1/memory/2148-1-0x0000000000400000-0x000000000047D000-memory.dmp	vmprotect
behavioral1/memory/2148-6-0x0000000000400000-0x000000000047D000-memory.dmp	vmprotect

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

pid process

2148 1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

pid	process
2148	1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe
2148	1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe
2148	1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe
2148	1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bbe827187c2a8623bcc490953e45ad7_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2148

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2148-1-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2148-6-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads