Analysis
-
max time kernel
64s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08-04-2024 14:49
Errors
General
-
Target
e7b6ec42218cf0bd927c7f601a187050_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
e7b6ec42218cf0bd927c7f601a187050
-
SHA1
865c42fc91b3672dd8077d2765154e31754d6e63
-
SHA256
754d8080fe95fe151d35e80a1029581018f8b2a143d594bc7e3fc8ab8dac10b7
-
SHA512
85e0793af390b26f248c72ceefd9c4abc4fdac40f5fd4678fd38731e84b092a443f40c6cd9f630e203e7a843284616eb56bf24cfe2c65ed86cf5713ad868dd6e
-
SSDEEP
24576:QqkTfTKhJODok3h+gP/KNWeycsNy11+cxyrc4qRpi4bIVR8DTjvG:k7KhEoM++K7XsNeLxyJqa004T
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7b6ec42218cf0bd927c7f601a187050_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e7b6ec42218cf0bd927c7f601a187050_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7b6ec42218cf0bd927c7f601a187050_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e7b6ec42218cf0bd927c7f601a187050_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD51fef473cfe6ed982ceaa37f99d2f4102
SHA17ced8a7a9d57b6d0795911d2328e8589b05ec1c7
SHA256ba23012dccf96538602988c854ce001b6051d4fb670610ac1f50171ea25b66e1
SHA5125e2cf34cdcc66ff704eae44cb3ae0eb4f3bfd4ef6eabf73a7d0bf6ccb7e2acbba02084e94208146c71de8b2179ce4084cf64c32af622270863a6f8724d7ccf04
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB