b2ffee4899f3360de69ba8bcd7d5429e8590b8a57b00952545904de0c05309a7

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe
Size

771KB
MD5

e92c7f189f5569e132e1bdf9d536f630
SHA1

fc60e5ebdb290ef96494027fca0e43aea2633dc5
SHA256

b2ffee4899f3360de69ba8bcd7d5429e8590b8a57b00952545904de0c05309a7
SHA512

e71da47cbff68b41a21dcba32d04583fe1ca6338b034126888402f5b760a87a14102c0bff3d85bd3dc4bc57e3ddee7d129ebee8c65aab6f19b586676ba42ece2
SSDEEP

24576:rsomsOAOcm2qCs1yb10hJaothZ2/T6FBBB:rsomsjOcYCs1E/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3512	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3512	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2132	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2132	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe
3512	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3512	2132	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe	87
PID 2132 wrote to memory of 3512	2132	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe	87
PID 2132 wrote to memory of 3512	2132	e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e92c7f189f5569e132e1bdf9d536f630_JaffaCakes118.exe

Filesize
771KB

MD5
c7215be2bb0bebd7f5e652ba9779bb0a

SHA1
59b78035045d782f6e26552b723d273387d94aac

SHA256
3fe7d70981defef54426858a97329a2e03dc2712e25513d39ff6fb1b7cfbeb2b

SHA512
4ce32656da90dc711d95e93f7556a590dd0f77ea3b1cb8c4fa55e4f9bd6e235684374b7b19014f09e46b8950c6c4bede518a29e41bfcadec174c3cd60e40735e

Download Submit
memory/2132-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2132-1-0x00000000015F0000-0x0000000001656000-memory.dmp

Filesize
408KB

Download
memory/2132-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2132-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3512-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3512-14-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3512-20-0x0000000004E80000-0x0000000004EDF000-memory.dmp

Filesize
380KB

Download
memory/3512-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3512-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3512-32-0x000000000B7C0000-0x000000000B7FC000-memory.dmp

Filesize
240KB

Download
memory/3512-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download