e76f2cc40a9bc287007b52a1b01306c212e4228f038fda8dd29220ca55b04527

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe
Size

385KB
MD5

ed1902124fbce92c9e2414869fd340d3
SHA1

4c2080f272b24b38b82776897d3ae2f9175d8315
SHA256

e76f2cc40a9bc287007b52a1b01306c212e4228f038fda8dd29220ca55b04527
SHA512

d670ac984717da918469ab29ab9668b66788624412cec0cd750349e125527acbc66bf2505ee44c3c9001ebaeaabb4fc897856489dffa62ba0558ebbc11b4f847
SSDEEP

12288:xKB9CsaTE/f1LDNq3Jm+WosfF4Szw+zaR3mdZAbFB:6Cp0VmJm+7sfmU12lmdZAZB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
876	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
876	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5096	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5096	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe
876	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 876	5096	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe	83
PID 5096 wrote to memory of 876	5096	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe	83
PID 5096 wrote to memory of 876	5096	ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ed1902124fbce92c9e2414869fd340d3_JaffaCakes118.exe

Filesize
385KB

MD5
785e437b7e1c5e0ee43cac065ba47e1f

SHA1
950ec4f86e1d79b386416aff4193022ef5e2a1d5

SHA256
e54963e6260f8e804b20c647107dc6fce521b0098d03ea40b189f7b2724298fb

SHA512
d8e6211d84b10b5060b3c12ade132f40fcad12108a503606b48608606d99aabcb3926363f42aab7371db7918b977a00e7710622c7d62ad4df668f0dc709fe04b

Download Submit
memory/876-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/876-17-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/876-21-0x0000000004EE0000-0x0000000004F3F000-memory.dmp

Filesize
380KB

Download
memory/876-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/876-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/876-36-0x000000000D820000-0x000000000D85C000-memory.dmp

Filesize
240KB

Download
memory/876-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5096-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5096-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/5096-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/5096-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download