Analysis
-
max time kernel
141s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 10:33
General
-
Target
f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f0d9fcc0823f182c4780599f9172613e
-
SHA1
5ad305c5ec69af7f3fa5dd64e3f727976231facd
-
SHA256
fa964284c00c634ff36f2558908145fd349f4c0da517a66b047da3dc73d7c3d4
-
SHA512
251ddb7fbaf4a46ac83c6c7ee05e1a38df6e831cd55b71aa8e431ea00e62a45935cb7145018189a231a0c8d21735002741444f32f9477fe2bb6fba712b2ec9ff
-
SSDEEP
24576:ry3yk5juDRkLKIMsPUTqWrCQkch3kc8RDtCYQ6i2Ze6j9QlTyOSvG:G30DmeRsiAUkc81EYQ6p1jCs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f0d9fcc0823f182c4780599f9172613e_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5ee9d91c2e5fc8f52e091d721db8448eb
SHA1e77a6ecb7ae9dd9ed2153b10a464e06730345faf
SHA25661904682cbb48142d82e43fe0e0f7d6073986ee96af1378172782fc9a5847dba
SHA5127db50c91c8a4a96018fce15cb9935b17e41612efca05e6717fa71914ae2b483a908df38082a521ddd45527bf9afcf39be89da57ee1883b49579fe907b83d95e0
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB