3dab160665b2a5a520304d2b3522c2307e310b94b8ce207c18c7802edbc52628

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe
Size

2.9MB
MD5

ebde6f09ba71f24a6a14baf4c08ddfa8
SHA1

895b35b0c8fef4f98bf1e207e303a2afc4194f5a
SHA256

3dab160665b2a5a520304d2b3522c2307e310b94b8ce207c18c7802edbc52628
SHA512

a4aa9ea9bde16d3e63c43abd87bc9dd36aa9197a2d75c63b5d0ae922c065dc404fe8429c3d9e36c209d33aeafd373460b02335cf72f38aa77081f7beb6e10798
SSDEEP

49152:sWIQ4JkuxdB3KoyrdbIBihe2kDWN74NH5HUyNRcUsCVOzetdZJ:hJ3A3/yRMBirkC4HBUCczzM3

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2500	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2500	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1032	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1032-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c000000012329-10.dat	upx
behavioral1/memory/2500-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1032	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1032	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe
2500	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2500	1032	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe	28
PID 1032 wrote to memory of 2500	1032	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe	28
PID 1032 wrote to memory of 2500	1032	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe	28
PID 1032 wrote to memory of 2500	1032	ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ebde6f09ba71f24a6a14baf4c08ddfa8_JaffaCakes118.exe

Filesize
2.9MB

MD5
812d441315d506264d7b07f4a75fae14

SHA1
06a758e2d8b560d1b06767733fbd81b962ee8e71

SHA256
e485dfff1aa4e057903b0d728af58ad9baa0fac4ff0c63308e073ec0a40a1ee1

SHA512
7009faad9a14b2caea0ead1db46f582f6451162fd01165366c7bed3795b08e6b3d0633900c74e3a6a52dde8fa28793bb4674613a948d8fddfe16ade6bdd1a10f

Download Submit
memory/1032-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1032-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1032-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1032-14-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download
memory/1032-31-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download
memory/1032-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2500-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2500-19-0x00000000002A0000-0x00000000003D3000-memory.dmp

Filesize
1.2MB

Download
memory/2500-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2500-25-0x0000000003530000-0x000000000375A000-memory.dmp

Filesize
2.2MB

Download
memory/2500-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2500-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download