Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15-04-2024 20:29
General
-
Target
f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f1dc579aab26e21eceadec0a392709ec
-
SHA1
59661cccf1c2d8ef5aadcd81e7f316319ee4cd4b
-
SHA256
0639974033c94031b6fdc04b1d44a3b37af0b8d03fe98e3fb13f1fb6100d9871
-
SHA512
d10e4a1052b1c813702592e80efedfcd3100952091394c022e81974594e1bfd4f93a9270590822e5399ca7c592abc1e4bfa0ab67990e85b4216003362f470810
-
SSDEEP
24576:Ex3a3t014+bIiavmtbzncQxFSWjww7BRJz5qBbvDIMc0nix5gk+GsrbeTagxvG:ER1wiav+znc+FSWjwqBRd5qBbY0q+1H
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5e335e5a4c51093394fbe62d8ad2fc477
SHA170e4a5942087ac58ceb55a48052bf41f2a055330
SHA256b591029e174a2da6b527f051090c2ac4d17665ff80f9a2261916510663c224c8
SHA512a65b46963b8066c2e009d651eb8de3d4dc3160fa3719601c047bfa8f9d0f7252e552b2219ddc32c7e97ac4779b0246ea18785d60f2ac813442e1de17cff6acbd
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB