10df1727cc3a6072b978c72fff96d92d3290b3ccc731ea9d6b1d720ed7d756f4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe
Size

57KB
MD5

f146fdcad0bc853f2a8df574551033bd
SHA1

ba525806d8acacbfcd6f360d898876af52598ba1
SHA256

10df1727cc3a6072b978c72fff96d92d3290b3ccc731ea9d6b1d720ed7d756f4
SHA512

e3b2737c3675b7aceb8e2810ffc698822e1b85b517342dd2653eceb3f81fb404b0f52311dcbf4b57246858cde36a7aeb863a46759a678c4f0cbf90ec94e587b8
SSDEEP

768:GG3SIdZwXJ92W5LUSGlcrIFVq9eXVA4Hmsz6WDbVCptShoiFXBkf4jcLT7JZbO7A:/3SiZwZ92W5BAFV7V0A8pwDmNLviLF6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1332	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1332	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2040	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2040	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe
1332	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1332	2040	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe	29
PID 2040 wrote to memory of 1332	2040	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe	29
PID 2040 wrote to memory of 1332	2040	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe	29
PID 2040 wrote to memory of 1332	2040	f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f146fdcad0bc853f2a8df574551033bd_JaffaCakes118.exe

Filesize
57KB

MD5
d480b8aa4841a57dbb5d58a83b161152

SHA1
873defde16a0a3f3276248f83340d39fcb7607a6

SHA256
acf8f4c4349767e1d93ddbabd7f3c2197a9ff56364faa53fd52b7b9d7d69bde3

SHA512
db6ad84cc8363e1251b0599c67cf0774dd2801a7c730ef968d6eced2cf322b3844eb6d85969a88d770c24bb3e95fc036b0ea2bff1a06d09b0b2f327ba17469fd

Download Submit
memory/1332-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1332-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1332-18-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1332-20-0x00000000002E0000-0x000000000030C000-memory.dmp

Filesize
176KB

Download
memory/1332-29-0x0000000000320000-0x000000000033B000-memory.dmp

Filesize
108KB

Download
memory/1332-31-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2040-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2040-2-0x00000000001E0000-0x000000000020C000-memory.dmp

Filesize
176KB

Download
memory/2040-16-0x0000000000210000-0x000000000023C000-memory.dmp

Filesize
176KB

Download
memory/2040-14-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2040-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2040-30-0x0000000000210000-0x000000000023C000-memory.dmp

Filesize
176KB

Download