0592531157f1807395a0b3aee37c6b842c7ce70d38bd74dad6fb9984f96644a4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe
Size

385KB
MD5

e7acb2498d165c67b43c9f0211884763
SHA1

832393b552b6696469ceeee807817fcfaaf0c886
SHA256

0592531157f1807395a0b3aee37c6b842c7ce70d38bd74dad6fb9984f96644a4
SHA512

74cd1ca7131ed9cf4795f1770db6321462b9702298c7683f3e8919d3777de31a83589da9fb1b355eafdd8944242875c6d8bbf106f4b3f8521375af10e36f54f7
SSDEEP

6144:OyIOkeObZKif5qEQlxIvj3867ESOGkxj8ixWWwi76jNXKnV6HqrbeAGCaP8RY/WB:OSKj5VQDITtHOG+DlUAA9AV9YevLB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1216	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1216	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4576	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4576	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe
1216	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 1216	4576	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe	86
PID 4576 wrote to memory of 1216	4576	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe	86
PID 4576 wrote to memory of 1216	4576	e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e7acb2498d165c67b43c9f0211884763_JaffaCakes118.exe

Filesize
385KB

MD5
f9628c462b519832eace0c24db94a710

SHA1
b007e5159e0a2a51aae504e9e83aa9ace6fbde44

SHA256
a69b9b5c36172d55a7b29940e0de09b2857dae61e4c9b974d758858020ad4c9a

SHA512
7285e37a79a4dc71dfe08dd661a31d5beaf249ad7af6c97908bc79f25a5b0c9523bbba139352b158faa5aa4ef10df2ea4719ef7fb7723e7ad039e6772cff26a5

Download Submit
memory/1216-16-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1216-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1216-20-0x0000000001640000-0x000000000169F000-memory.dmp

Filesize
380KB

Download
memory/1216-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1216-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1216-37-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1216-38-0x000000000B7E0000-0x000000000B81C000-memory.dmp

Filesize
240KB

Download
memory/1216-39-0x000000000B7E0000-0x000000000B81C000-memory.dmp

Filesize
240KB

Download
memory/4576-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4576-1-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/4576-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4576-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download