f937d1102df2675e8832c45690f2a74f48dffe15abf83b4353bf185228f803ce

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe
Size

385KB
MD5

eca0c75ad84c5a2b3e3f5553000bcaa9
SHA1

fb2c0abc14dbeeb3efd7a7110ae0acc1794c3ecd
SHA256

f937d1102df2675e8832c45690f2a74f48dffe15abf83b4353bf185228f803ce
SHA512

951c6785ac4934c738bac5ba21b601d4390f60f384c1e0fad830b749f2bf1dfba85b5777e4e7253fb3ee91d86c6066352efaa0efca3143f4ee95514e063c7c39
SSDEEP

12288:I/9pqad3vXQp9nJTmrrU5y6BUqMn3wQkJa/B0togGJXQEBB:IFDIrJ6nUrUqMn3wQZp0togABB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3628	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4292	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4292	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe
3628	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3628	4292	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe	90
PID 4292 wrote to memory of 3628	4292	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe	90
PID 4292 wrote to memory of 3628	4292	eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3732 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eca0c75ad84c5a2b3e3f5553000bcaa9_JaffaCakes118.exe

Filesize
385KB

MD5
25ca305dc6819c82fbc6d73d1858cb22

SHA1
97a88b159f626ad891112318b57d587a9e9e0fb2

SHA256
0dc76810cb2f5b56c655b1e3acb37bf06f56b0325c7658301396bc029ccdc558

SHA512
536711ab69ec4a4822226100794f7ebd247328e2439a7bc47c35b3bef94e07afbf00f44cf601d5d72c2151b9dba32f7ab5be68f762ab78106dd1f33343503852

Download Submit
memory/3628-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3628-14-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3628-20-0x0000000004EC0000-0x0000000004F1F000-memory.dmp

Filesize
380KB

Download
memory/3628-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3628-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3628-37-0x000000000D820000-0x000000000D85C000-memory.dmp

Filesize
240KB

Download
memory/3628-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4292-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4292-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4292-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4292-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download