Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
28/03/2024, 16:42
General
-
Target
0ac653755d1db8f088ac3f3aac63211e_JaffaCakes118.exe
-
Size
82KB
-
MD5
0ac653755d1db8f088ac3f3aac63211e
-
SHA1
a6a4bcbb9a1b449676f2fb9f27faf544b59c8f7d
-
SHA256
493fcbc3c85ac57f73e8b96c3b4fc8ffb12d9d71d43c780e39df6207d437d1b4
-
SHA512
96d64aa009721003e92a1b2dc48151aa5b103117bf847430fd8d2025e06d1eeb63158a62f23ea39ddccf4c364c1b9c288003005a4dfe2b54f82a178350d98a67
-
SSDEEP
1536:ywTHeCP7l7cICyLFNr6rO7LAodrnmIwX+1/bdJs+nD8dwWChOrbK:ywawl7cIf3urtermIwXSACgdCK+
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ac653755d1db8f088ac3f3aac63211e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ac653755d1db8f088ac3f3aac63211e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0ac653755d1db8f088ac3f3aac63211e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0ac653755d1db8f088ac3f3aac63211e_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD50670083a76791eabf14f6b34d2f96906
SHA12927183e243f3ff4e633fc921b791b4d61d5e1b1
SHA256f760ed4f265335fa7c223590d9da4329d08a6ed17ccf921c44ae46a20198ad7c
SHA512b9e84012542a47a0ee45c8cbfac0a08953385a5af028727199ccc5025b4c6bcadd387859c12e059493c422041298c2814362641403969affd2c8ecd61aa07516
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
188KB
-
Filesize
108KB