368cb62588fc91261a16af9c60ae9a1fbcc5238c650775b99005a5b8f5689c97

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe
Size

385KB
MD5

e9fd8e4c5f8de677e2dc227937be80a5
SHA1

f3ff5387120d7ebc9036ce9268a41610d8e94f18
SHA256

368cb62588fc91261a16af9c60ae9a1fbcc5238c650775b99005a5b8f5689c97
SHA512

a0e39576d1de97488614852aeebdf995473d2ffccfb2d8bb6fd166a4923da1bfeef08d449b24423237d565b32578db736e1b8c6ac3d5480977a7f80b80f75b85
SSDEEP

12288:P9vfqn79cQYGA5lwOHtX5dVmKKZ3bUfMvO7GyumfnjB:PKRcQYGwlJnjTMvztmPjB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2028	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2028	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	pastebin.com
12	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3120	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3120	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe
2028	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2028	3120	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe	94
PID 3120 wrote to memory of 2028	3120	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe	94
PID 3120 wrote to memory of 2028	3120	e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=760 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e9fd8e4c5f8de677e2dc227937be80a5_JaffaCakes118.exe

Filesize
385KB

MD5
6e99dea0549c07005a6dbe4ecc578235

SHA1
aabbf9ff8ab6460fcf472e5f8cee45ff38d82287

SHA256
425810ff65b96c6638e26b6dd13c3011f991b8249aee5fc55635acd36628c070

SHA512
2c97831c87ac805b6e2385efbc90dc25a9d64de7743e0188e42581b2104eae6f6e901b6e91d1426597e70e9010c53b9cfb6ff08b4d993f529f23dbe402319b07

Download Submit
memory/2028-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2028-14-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2028-20-0x0000000001600000-0x000000000165F000-memory.dmp

Filesize
380KB

Download
memory/2028-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2028-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2028-33-0x000000000C800000-0x000000000C83C000-memory.dmp

Filesize
240KB

Download
memory/2028-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3120-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3120-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3120-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3120-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download