Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
16-04-2024 02:26
General
-
Target
f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe
-
Size
105KB
-
MD5
f27986621bf6a182f5bcba2b9acfb266
-
SHA1
94c0845c4cae24b3f3228d6951ac5a30e61a1a25
-
SHA256
b30d3db55daccfb14482649a7512c2495352c01b0b6e835136d714e49dc27615
-
SHA512
b27407dc5642336732d0644c47357115ba36c334ee874c9be151d5b5dbcec58c9d1db1e3fe5984ab629bdb1f760b7337e2bcc67c519e148cf747f17ac3dd5e74
-
SSDEEP
1536:jB7OI4GnV6RJ5e9BVzdxMe4ISMbVItEUl1QumquZFGNHd3iTt6DtW9YH:lCI5kynzdxuIHNUl3ub6pW9i
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD51d7d529bf4d257940b5b396c49d54555
SHA1224f92dcd5f79f710cc72e95cbfc821906fea273
SHA256633b82c072f9445ee41e4e3af916d98e5142154632ea6d94921dd2750431cf0b
SHA51297f10b3d05a93881b410cf47e4db03dc9b4025c616a532cbdc1c081d59ca196281d042eec74c068cd1ab8f1c6c453cb77359936dfdc710ef26b304a7ed3147b5
-
Filesize
56KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB