ee74f2a2f7490adbb028b3e60e1fdbb5ed47cf5aebf59df3fb689103522c6310

Analysis

max time kernel
125s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe
Size

907KB
MD5

f0aad149cf413eaa68edf755ff23cf79
SHA1

665b56960f655e389f7e5dc8aa3cac9744992909
SHA256

ee74f2a2f7490adbb028b3e60e1fdbb5ed47cf5aebf59df3fb689103522c6310
SHA512

3211a23ebad807e1dae03f1d074ca3e236cb2ea843ec8bed76542a5148759c82110e540fb78b846fbfb275fdbbe09525586d3739c6d42fe7c83d991262a2477e
SSDEEP

12288:kZ8h2QPynuo9yFA+zOy95aXM+QLJtwmD6Jc2JxpHqvm/SjwCxKVjVDa/ZS1:/gQa0AwBGXM+m9DaceKuCkLa/ZS1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3736	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3736	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	pastebin.com
21	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3024	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3024	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe
3736	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3736	3024	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe	95
PID 3024 wrote to memory of 3736	3024	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe	95
PID 3024 wrote to memory of 3736	3024	f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,7447082786332118630,10839110169592584063,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f0aad149cf413eaa68edf755ff23cf79_JaffaCakes118.exe

Filesize
907KB

MD5
bcf11b4499ac915a9f541fe3aa3bdd1e

SHA1
9e15ce2e703cac2341a031f3dc77da5f5f7b53a1

SHA256
27ae1c7474d3510a2c9809a169b47c3dd9c258dff861006b82d276fde923a8f7

SHA512
28d43925856187192cb48cac2937adc42c69befb305d71c98ccbe9593a104f9cc3cbbbdb7fb423507350aa66eb373288359b0a8c03c99d80f923c0a0ab118075

Download Submit
memory/3024-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3024-1-0x00000000015B0000-0x0000000001698000-memory.dmp

Filesize
928KB

Download
memory/3024-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3024-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3736-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3736-15-0x0000000001680000-0x0000000001768000-memory.dmp

Filesize
928KB

Download
memory/3736-20-0x0000000005030000-0x00000000050EB000-memory.dmp

Filesize
748KB

Download
memory/3736-21-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3736-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3736-35-0x000000000C7D0000-0x000000000C868000-memory.dmp

Filesize
608KB

Download