Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11/04/2024, 05:40
General
-
Target
ecc71f49a0f80bc795afa02c68f6aa01_JaffaCakes118.exe
-
Size
82KB
-
MD5
ecc71f49a0f80bc795afa02c68f6aa01
-
SHA1
e20644ed825bf77df54e0f75387f026947d5b512
-
SHA256
0f06d2a99379034a9e31a27c2102deddfdb8afc98afcdaac9d12da7f6f481766
-
SHA512
d13e881cfef65e8a95810e87308a5f6a400a14a21ed30e4333c212520b3ec435a0b4b9c46efa5fc2ff4fd487c825ae7040b120bd8c136ed7a31970b9e4d5fac9
-
SSDEEP
1536:AOHTpjr90mZqlfVdU5Vv5XJbP2Nf4YismffiJTE0VJBS53SgL4pTNM:AOHFt0llfPUbgfQs0fYI0SdZLE6
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecc71f49a0f80bc795afa02c68f6aa01_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecc71f49a0f80bc795afa02c68f6aa01_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ecc71f49a0f80bc795afa02c68f6aa01_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ecc71f49a0f80bc795afa02c68f6aa01_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5ca8f8c8aaaeeb0c257a2b25694869a2d
SHA1281a492b24b191c042e0e18e962af46af1e6dc38
SHA256f6fd4bf6dbbd762575645b0b4c9bf90381a1895ae3555baf75d75ef328c779ff
SHA51256a860d07d0056781fdaf184aec40d178f42c5e6afd8fe4748b8bb43069d9aad598da97524a319ca11cbc6c4339be36cc5645af57f98456770d487a2037a1e24
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB