Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
09/04/2024, 08:08
General
-
Target
e9888c1972b2ad7eb797d48552dac0b8_JaffaCakes118.exe
-
Size
82KB
-
MD5
e9888c1972b2ad7eb797d48552dac0b8
-
SHA1
30307235b28dcb1dd33eca8c08ce4af8a421afe5
-
SHA256
3739b046a4816b07a0e58e2c62ab331718b6f77d763e34c118340c89539b2d58
-
SHA512
4dd8a4f09c245e85af86254997f2fbe7ef01d62803741bb3883f29def23aded56143b7e1aa6a086b5604a06d2d9bab59bb91095dfc3a05125c0f866989c2108d
-
SSDEEP
1536:Y/GngAN7GEUltPIeIehWCtBlXM2nIL/jIKP8jFtHuPUSAS/XSh:Y/Oy9oeIY3tpna/jbEh1uXAfh
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9888c1972b2ad7eb797d48552dac0b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9888c1972b2ad7eb797d48552dac0b8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9888c1972b2ad7eb797d48552dac0b8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e9888c1972b2ad7eb797d48552dac0b8_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD527965eff03adfb895836a9b014ea8447
SHA1e6a9277af0b9dd219d572cb5086c18791b415b1b
SHA25659bd20b6b4f0bfaf1b8dec37e9b08cd84a08f8b26f062306ed3806a043e058a3
SHA5124069098a1ed97151af0b4ccc5d11fd1a02628361bec3d13ac4b82b892d60ddf30865301a9079689f602b79d85b1965adaafb302c6cf3d1e124f7a151722c541d
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB