Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08-04-2024 17:14
General
-
Target
e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
e7fdf1e6b5fe272443b305fdde093e9c
-
SHA1
84d9bab571c7ecba8343eeb2e4957928624df9a4
-
SHA256
12db789012b013720fb523de590b37530133bac18585d4698053cab2626b3b63
-
SHA512
10ecfbafa8df7d9f01f9e77f6e369cbc195c302285dcb1560f6d271daecf743ed1ed2730c5511256d2ac9a4bc1068a06a6f1ac8b77a7268b0217a32d376d8d88
-
SSDEEP
49152:habTEzobVArJO/LYQND+UUWVN74NH5HUyNRcUsCVOzetdZJ:habx0O6YV4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e7fdf1e6b5fe272443b305fdde093e9c_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD54bae0da37007e552947b99a7a97319bb
SHA1b1a5ddd2c7f0bc6431beae5d673ccf9e02729288
SHA256b78bfa241cda19fc7875cc835ad4a42f69dc1e507786cea385d37981450bb022
SHA512b7440d1957cca9eb34131a74ebcbd67ee0d43b8891f99e6f19ba924e2111a73fe049b0d1cb3ffdeff67cb9258ddbf4e49556cf7da891278cf2791ed22deeb37c
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB