03194dd03b4597c32ffcc7b9dc3470021437997075373a5265d493b02806f339

Analysis

max time kernel
127s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe
Size

385KB
MD5

efe5d6ac42fb640212302a17b1ec2345
SHA1

06f15d5be5b65e20460a342d1d154a958ed30bb9
SHA256

03194dd03b4597c32ffcc7b9dc3470021437997075373a5265d493b02806f339
SHA512

1fcfc5d3dbeccdb8f3246fd623192ec64378c8462f9b4c0ebb70af84114222fa17e594607b9a6ab5b1d3dc4785fc128c5e50f7f8d4b2bf93f49dcd7ddfafdf57
SSDEEP

6144:7HRo4utBo8ApJMdcVjvmMI5N0jLhe+uLwhohO+z6NPLSX7ihFZB:bRo4qSMCcXN0Re+DIH622hXB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1524	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1524	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
14	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3880	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3880	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe
1524	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1524	3880	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe	94
PID 3880 wrote to memory of 1524	3880	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe	94
PID 3880 wrote to memory of 1524	3880	efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4000,i,3743841324023353050,5931777343998032160,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\efe5d6ac42fb640212302a17b1ec2345_JaffaCakes118.exe

Filesize
385KB

MD5
cf40545f0a64610347b4dc1defdf72dd

SHA1
433b015fb81cb48ac44bc3f1783195222aaef63c

SHA256
4ae972d7b4b73b38a563378951458312881689b266a74b00f1c2012eae34df6e

SHA512
4c15601559981f211bcb69774bd86a25ce0960dbca0d5ef886fe3004125e6e6c61e5545006cf889280c324add979892d127f07ba741f5e4a5123784d8ec8bfd9

Download Submit
memory/1524-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1524-16-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/1524-20-0x0000000004EF0000-0x0000000004F4F000-memory.dmp

Filesize
380KB

Download
memory/1524-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1524-35-0x000000000B5B0000-0x000000000B5EC000-memory.dmp

Filesize
240KB

Download
memory/1524-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3880-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3880-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3880-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3880-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download