Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 12:08

General

  • Target

    ed636897081ed24777d1dc75563a71d5_JaffaCakes118.exe

  • Size

    385KB

  • MD5

    ed636897081ed24777d1dc75563a71d5

  • SHA1

    6d4e958009338821607dafba62b7bd15bd497a32

  • SHA256

    abc8f71dac001f77639e23417e61f49bb1c7bff1a6170190bb7987ac8f8ccc8f

  • SHA512

    7b1337504c59e47b73f0a48bb5fd7a747d50d7d0b4eb48d20addc9eb00c039e45a3bf04af79308eb9e735352098a3f592c0886a068180c5973f91f44fd2b8bb7

  • SSDEEP

    6144:jhlB6TwS3Fn3BORpiZXsEceW/4YqPP9yIf0c5Q6zquFUqZIitQnQryoB:jhl2t0GXsEU/4Yq7f0cHmuFUjoQnQr3B

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed636897081ed24777d1dc75563a71d5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed636897081ed24777d1dc75563a71d5_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Users\Admin\AppData\Local\Temp\ed636897081ed24777d1dc75563a71d5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ed636897081ed24777d1dc75563a71d5_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ed636897081ed24777d1dc75563a71d5_JaffaCakes118.exe

    Filesize

    385KB

    MD5

    a30147baa37522c5e3c61730113d4f3c

    SHA1

    a0122c9314a412af468806a35e93577eb62b1834

    SHA256

    fd31f9e0362968b7fa7f68776a3e5dfa472dc4bd816ca77f520d72fa21835eb7

    SHA512

    93d68c823e40d0d793059564f29c7ee13322f3d86a3c4cead857bce10c0b0026f3433012cfb9031a7c3daf90e4d2ebac35538923b6709bf9cbe8e95f975712cd

  • memory/4896-13-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/4896-14-0x00000000015A0000-0x0000000001606000-memory.dmp

    Filesize

    408KB

  • memory/4896-20-0x0000000004EA0000-0x0000000004EFF000-memory.dmp

    Filesize

    380KB

  • memory/4896-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/4896-30-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4896-33-0x000000000C800000-0x000000000C83C000-memory.dmp

    Filesize

    240KB

  • memory/4896-36-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4932-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/4932-1-0x0000000001470000-0x00000000014D6000-memory.dmp

    Filesize

    408KB

  • memory/4932-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4932-11-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB