Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 21:39
General
-
Target
ec0c49c348f4431b78cecea540a846db_JaffaCakes118.exe
-
Size
82KB
-
MD5
ec0c49c348f4431b78cecea540a846db
-
SHA1
ceec681dfd4294ede5495c06c5f490f687e0755c
-
SHA256
4fd3e52c74a5e1bcd1ca9b7dda547c92ea3fff4903e79382746106fff1c70b8d
-
SHA512
19f4fb4eb5827cdb862cc63ba2eee5a44d920c58ff40ecce733ca3657c76c8ba584db3f003af7aec5bca56999bed0fd80482590361964e96306c5ec80d135153
-
SSDEEP
1536:/Z80AV/B+JPnowC7mNIDX+vMhxl8YkFQ10KW9Iu0/0DODgbwxRUWy4ICf3u:R8no/owCqNAXQQxsQ299CDAj4IC/u
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec0c49c348f4431b78cecea540a846db_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec0c49c348f4431b78cecea540a846db_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ec0c49c348f4431b78cecea540a846db_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ec0c49c348f4431b78cecea540a846db_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD551b01893e68f88502726904709c542b8
SHA1756656a01bee805ee9aa9ded87d2ee0dbe115953
SHA25607e637fd72d4435f2b95d2dd7e97c2ff3d49f4c60e3c3e43bf78a79c35f5b173
SHA512ec2f814a4fa6b40c67446bdc87b9ecd98faa60957bb67184d93f49d1a43b59c68cdb9fde915323c93bde3b527f8267d70449ae664ebd630badce937faa4eb9c2
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
188KB