Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/04/2024, 13:45
General
-
Target
e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe
-
Size
56KB
-
MD5
e79842014bcf82dd28bf24dbf4d77518
-
SHA1
be395054234bea9e1538fe5cba82cc0bc960a9ef
-
SHA256
3faac1faf34d3643d4cbd6ba3a02d04840216e8589a1c332fb0e8d728526c48a
-
SHA512
e0a96b34351c38adf60b9a88efee1ff9fcfa342c39bdfdb85fce877d59d11cf8f1f410a98211fbe2c075573340e084d34fd36aa80054f5c78cb1aba57426e570
-
SSDEEP
1536:L1QF5SVod6jhI824GrDjCUAWSEl1pINPyBSCdBhbvDV:ZbV86uDf39DlSUdrb
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e79842014bcf82dd28bf24dbf4d77518_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD59e1be9479d772a68a78b3e195b40c18f
SHA156a949bedeb4cb8155f18eb48cc7eed32925d2e0
SHA2565638cf955abca7654deb09a750858737776188cd337b5582d6bf1c14be7d16bf
SHA512dd933e918559c83018a4c703e73c4c481976c0787c180285fb6484fab695b652633da9aaf7efbd94eed2d114fc4867e2525c7b2656cee0a71e829f4298fb97ee
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB