4373aa6bfc8786f53d10d6654b593121d735a6feca6f84e66b892e2c61428482

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe
Size

385KB
MD5

f2673afa883760ebdabc5d8eaa6ea9e7
SHA1

8878ff2dc4ecb8517175a96ee2ce358887deca9e
SHA256

4373aa6bfc8786f53d10d6654b593121d735a6feca6f84e66b892e2c61428482
SHA512

94abb3d20711efd16f598ea35dea85ead4996cb4df520c8aa2804f53eb39aa3330b86f4377bbb5393fa6ae22d647b09531395f113b40d2049eb6aff6923d1dcb
SSDEEP

12288:hluqLWh649mnHBMHQy6TUgc8pebsATkQPB:hluqLWh6A4ur6Ug9GsGkGB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4764	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4764	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3256	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3256	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe
4764	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4764	3256	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe	85
PID 3256 wrote to memory of 4764	3256	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe	85
PID 3256 wrote to memory of 4764	3256	f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f2673afa883760ebdabc5d8eaa6ea9e7_JaffaCakes118.exe

Filesize
385KB

MD5
182073739a4811bda1ae54d620546d15

SHA1
e8f4fddcad7db915c27f0b0269bc8e365d4a3c13

SHA256
8a5ccb9889bf16437a3f42816ee856bf3c933c09d22e4871bfeb8b7c5898babc

SHA512
fd3e48f3b9d141664baa9ae2d4b9fcc099047c12afbce03d2c76865f230afe5bb5701301ad9f842cf064e1893a186b20f8771b71ba36413941fc173597c6d6a8

Download Submit
memory/3256-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3256-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/3256-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3256-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4764-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4764-16-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4764-20-0x0000000004EE0000-0x0000000004F3F000-memory.dmp

Filesize
380KB

Download
memory/4764-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4764-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4764-34-0x000000000B7C0000-0x000000000B7FC000-memory.dmp

Filesize
240KB

Download
memory/4764-36-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download