Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 08:33
Behavioral task
behavioral1
Sample
f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
f0aae430c73782b8497480122fb54d49
-
SHA1
f90ce5853758703b94dc5ec9dcc91aa68f3bc79f
-
SHA256
0cf9f345fb1d5ac3ebc548f8730c60e5b95c2292286d23c58d7c740cf52fad9c
-
SHA512
8994093cdda71edd8f88b5117f30a1c0abbe37c63e65059f2cfae1302fc8f767c032eeb83e2b66c6401747a43b1a7d4c9e093dad291cdbd6918d703d4f2d7774
-
SSDEEP
24576:ar2hfzEfGzNZYtJQI7IIMAm/UDdkCTDxWD/IKgO8vA82Yd7cdPZk220BcW:RRNmtJ90I2Uxb0Rgfv92Ydgd7hc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1752 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1752 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2700 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2700-1-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral1/files/0x000a000000012241-10.dat upx behavioral1/memory/1752-16-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2700 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2700 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe 1752 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 1752 2700 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe 28 PID 2700 wrote to memory of 1752 2700 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe 28 PID 2700 wrote to memory of 1752 2700 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe 28 PID 2700 wrote to memory of 1752 2700 f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\f0aae430c73782b8497480122fb54d49_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f0aae430c73782b8497480122fb54d49_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1752
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5d806ac9ad4a4556758c7a9a78aa49915
SHA119267c48ff2cd02c26695497450003a1771a10ca
SHA2561079644489ee42f179ccd4e49405efeee0a2fb3414c56329f0a59bd8822c5962
SHA5120342545d6f34dd5051af78ab406832940a7e780f9d4c848c2970ae47e416b7dd9e5748228a9aa88546483501330c3c51891b6fa8f65c06464a3960ce20e809eb