c4b6d99a1abce44dce174360877594a971f538cc0b2cc811c71294b6981fa505

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe
Size

385KB
MD5

e845c2b38d314cedf02f0ccaa8f0661f
SHA1

00ef2d4a63d2cb59d4ebce2c00fe77b269558af4
SHA256

c4b6d99a1abce44dce174360877594a971f538cc0b2cc811c71294b6981fa505
SHA512

accce97dad1fb48fd9a1912ebd5a4a3cc03e694b25d1b89c6e619d822dddf61d38f26888d9bc2717d545dcbc6bee0b88adb8107f88423a11b1dadd9ffc25bcd1
SSDEEP

6144:pY5HEEu+4Focus6MhtokQT491Bt7l1mhu65YuN5kMz9e3k05LgdqthsStQhclzUm:4EEGaLKoxI1jLuu6N5kQsZQrQlzB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
848	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
848	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4564	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4564	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe
848	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 848	4564	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe	86
PID 4564 wrote to memory of 848	4564	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe	86
PID 4564 wrote to memory of 848	4564	e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e845c2b38d314cedf02f0ccaa8f0661f_JaffaCakes118.exe

Filesize
385KB

MD5
016c6d1dd38573406bd3a93e69646ad7

SHA1
a9a5d51c887ac86a10f4ed493d954fbaca0eccf0

SHA256
eee8171076b853328b29524ac7ce9e21f776d25b7badc28e931a8eb5283d2a1f

SHA512
883201c762bfb9b4714b874d759a7deb0d0b2685cf75e34953247db67b74cebbf2ffa72c90bd061d1f1132910f5f448eb0bfde454cb8749224a2e3a1ad49b9e8

Download Submit
memory/848-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/848-15-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/848-20-0x0000000004EA0000-0x0000000004EFF000-memory.dmp

Filesize
380KB

Download
memory/848-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/848-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/848-32-0x000000000B7C0000-0x000000000B7FC000-memory.dmp

Filesize
240KB

Download
memory/848-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4564-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4564-1-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/4564-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4564-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download