Overview

overview

7

Static

static

7

ed6cd2dc1e...18.exe

windows7-x64

7

ed6cd2dc1e...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 12:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe

  • Size

    2.9MB

  • MD5

    ed6cd2dc1e7fa8ca1402b624a10617e7

  • SHA1

    70aa40a6ad2ff6b4acb5d9b13485e59fe0930ced

  • SHA256

    bf7d74f7d8da08e6c841856dcf431ee9db35c49b07d9f3e7b5ef27a8f0a93395

  • SHA512

    4bda8922a4dd563ede2e3be6a4a12c717874b758d9afd8056b50feb7c81ae9914beb39552511d9dfaf02aad0c8d925580d1b06b9751a541a6c6e659d6a2c68ba

  • SSDEEP

    49152:haLkv/bZT/efrBJvXjKtzh14UhuRD5TP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:hYkv1WTBJvmlhWgg3gnl/IVUs1jePs

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ed6cd2dc1e7fa8ca1402b624a10617e7_JaffaCakes118.exe
    Filesize

    2.9MB

    MD5

    5e3602284ae43a9e970555698c6d2632

    SHA1

    4a45e8b9db9979a9324ecaf21cd7cf3d8618a413

    SHA256

    2e2737ed490d15cad19dc560dfbe9f429e5fe1a9a0fae90471616b5ebb09bb83

    SHA512

    b16d8f052a641519cf9a9439efdc67fa6307d3bf0af0227f412f66023cd49ef91dd60dfb1dbe2060e0f348db786aa893e9cbe809ef4d56e342966335ff8498dc

    Download Submit

  • memory/400-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/400-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/400-2-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/400-12-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/4368-14-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/4368-13-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/4368-15-0x0000000001DA0000-0x0000000001ED3000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4368-21-0x00000000056A0000-0x00000000058CA000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/4368-20-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4368-28-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download