Analysis
-
max time kernel
95s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 01:38
General
-
Target
efff5fe8701b3c275b4ff07abdcbda6d_JaffaCakes118.exe
-
Size
5.3MB
-
MD5
efff5fe8701b3c275b4ff07abdcbda6d
-
SHA1
94058a331cc6ba99d93d9bfb7ef4700b16cd482d
-
SHA256
1928db2bff30cc04bc260f19ca0f723843666bbfd6fa7df6f01950ad4d7bceec
-
SHA512
cbe7f42138e1b24066078d274410b4a4422a2a8ea9989217f0099e078684b2c9717151a6ca21c31b109d6a8671d6b0d479b1d184213a7ff5145ddf8e633d916b
-
SSDEEP
98304:8Nhcv7YoVkd32lShP8qTKvqjMQkXrNhFjOuTkKd32lShP8qTKvqjM:cmjYoVvYO8Kvqjy7NhxOuTkZYO8Kvqj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\efff5fe8701b3c275b4ff07abdcbda6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efff5fe8701b3c275b4ff07abdcbda6d_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\efff5fe8701b3c275b4ff07abdcbda6d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\efff5fe8701b3c275b4ff07abdcbda6d_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD5b273e760013e53edb311d7543fd17938
SHA16312519c12cb539742f413eccea07a44c630802e
SHA2562b6d225870416e3432e2c3659b0c321b196f2f3153865bf2c8ec777c2e450807
SHA512d88ebe1746649f35639e70e6182ae62e7a58022e0453c945e2a5c402ca72fd32328a43833e803f18d539a18824098d30ce4d9590f17226d1532544f5c23b5c3b
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.5MB
-
Filesize
1.9MB