Overview

overview

8

Static

static

3

f46d78b847...18.exe

windows7-x64

8

f46d78b847...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-04-2024 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe

  • Size

    41KB

  • MD5

    f46d78b8479b9a6725033ef735592f29

  • SHA1

    eb3f8e5b69b10b69981eb393196e271647915e09

  • SHA256

    e62afa50e544b603860a2c27a9b9acd68406f2166d70c0ec8f5a0444a3fcb068

  • SHA512

    ae0bd8d90d11230457431e967f1fb24a60db9e61794ed3783783f95cb76a4e8877be54e522eb40331cae214ff7425d64b5609e40fb1a141f384ad79175b6fd2e

  • SSDEEP

    768:WpPNrGptLp1p2pZpnpaply9yo/cpI1gkuebVSzO9uf9shtN:+PVOtFX+zp6lg/caluebV+OYY

Score
8/10
persistence

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f46d78b8479b9a6725033ef735592f29_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious behavior: RenamesItself
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2912-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

    Download