f2bcb5fbbae1038fb19eca907dc8a966ccec740c79c19a80f7e1f5be4d2fdf40

Analysis

max time kernel
90s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe
Size

385KB
MD5

f20a05a07a5991ca6a0e206e64db2117
SHA1

a627e3b4073bb83d93ce6f50ef118ec9dc2e4209
SHA256

f2bcb5fbbae1038fb19eca907dc8a966ccec740c79c19a80f7e1f5be4d2fdf40
SHA512

c457003d3f49b46f2f10a7dfb01e57dd6dec582c000ae77750a4c2152416fc53183c80387c9ca9c6f83da59ebcb2cb2590077f06b4bcb656376a9c22cc13d94d
SSDEEP

12288:dZR9j8b5EEHG9kUrVleKAT6QDViCAQfgC8B:PR94+Osz1yDViCAoV8B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3876	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3876	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
11	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2660	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2660	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe
3876	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3876	2660	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe	88
PID 2660 wrote to memory of 3876	2660	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe	88
PID 2660 wrote to memory of 3876	2660	f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f20a05a07a5991ca6a0e206e64db2117_JaffaCakes118.exe

Filesize
385KB

MD5
e59d48b172723efe30d07d1c4f467d11

SHA1
cb5bbe3b1f564aecc67b248921546a71bb67492e

SHA256
89ba67ab7b7aba3cf9e40036bfdeb0f409872aaf8b3b26d6abfbed534f56abbd

SHA512
c716f2fc4f49a78226a9676c30287ea64d74ca8976c517608c6c2b77a8b3609a2330214d50122987859c79ee3715253b6798f1c5f8a39a885942827fea6e10c7

Download Submit
memory/2660-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2660-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2660-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2660-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3876-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3876-17-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3876-20-0x00000000015E0000-0x000000000163F000-memory.dmp

Filesize
380KB

Download
memory/3876-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3876-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3876-31-0x000000000B800000-0x000000000B83C000-memory.dmp

Filesize
240KB

Download
memory/3876-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download