Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-04-2024 05:39
General
-
Target
f06fd59c6eb4fd2d21b35785210842ab_JaffaCakes118.exe
-
Size
82KB
-
MD5
f06fd59c6eb4fd2d21b35785210842ab
-
SHA1
99dd05fc00e64abb5ca9d79dac46f7ab9ff2b8b6
-
SHA256
fcc326df6bd3f78c81bef2ae786d196b15dd72531b609a5798f342ecfb521d38
-
SHA512
8e84e21b982ad084899f8babd0401da1e718f66b7da5027c25b852987cc18066404663128b2b2b658ecd6a1056c105493b4cff7f62f8b109ea35c1083751a46a
-
SSDEEP
1536:UhA890wtiSxPAXmjBTilTfeoAkVrITqEYOtQmjZBfE6sNMI52LTK/wSLWcH6z:e9QSGXmjBTeJV5OtlDfE6xxLTK//K66z
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f06fd59c6eb4fd2d21b35785210842ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f06fd59c6eb4fd2d21b35785210842ab_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f06fd59c6eb4fd2d21b35785210842ab_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f06fd59c6eb4fd2d21b35785210842ab_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5965dcb164f808d3c6ba0f13c344d0c2c
SHA1e7beb8a01ff2978de253bc1a515a9b23f0816ced
SHA2566dc04b7a9f2d938342d2e6cd1d541c2facaee2123c652fed0374ff4e046562e5
SHA51265a5ad4400c932df78b9c6043fed928e08a6577b4d307f8aecd7d188c9cccb8548585602012a7217c7b64947a45f6b9e8620895d7900295f5886b8344b1f5bfe
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB