7ec1c6a40cf97c6b73745d5c8aa11d24e027315dcd131454b0c1ef6d9aee2b0a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe
Size

385KB
MD5

f2e1f8698577e9507a4f8c1a8427f0f8
SHA1

042ace0826594b36f9d651db0eabed8f39a8ec2f
SHA256

7ec1c6a40cf97c6b73745d5c8aa11d24e027315dcd131454b0c1ef6d9aee2b0a
SHA512

ed1bcb4d0c1d41df100769a20df1fec5d60a4d1dc74fe155d506e1a9773aafe61e20b2268d4c260f2adf08f7d6617863d702b4de31110e588e461a5c6c3e98ef
SSDEEP

6144:CFYrdwTt9CdUMgJmxSKuLOLWQXTCa/yzDPmjYd/HvIUUD4PUcpoGTCq9knXB:CFYr8aUMgJqSKvL+a/wqjYdfA08I05XB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
940	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
940	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2772	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2772	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2772	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe
940	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 940	2772	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe	28
PID 2772 wrote to memory of 940	2772	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe	28
PID 2772 wrote to memory of 940	2772	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe	28
PID 2772 wrote to memory of 940	2772	f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f2e1f8698577e9507a4f8c1a8427f0f8_JaffaCakes118.exe

Filesize
385KB

MD5
9afa3818dd247dbdade95a8542b7a380

SHA1
912ee534659e7d902cc6706fcb70dc16d796862c

SHA256
8f39b357b28ba63bae4197b0624caefcb12c0d192f27af6e94e9f33ce6404d71

SHA512
9f4e1f670ea237c7e28b3bb3d4d6231dedfcc939d7d124b47a0934ff2e36eca0fcb620f75077a90d1a8e85e0a981feffdb2cc2cc448f26d0b8315a2c757d95ee

Download Submit
memory/940-16-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/940-18-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/940-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/940-26-0x0000000001470000-0x00000000014CF000-memory.dmp

Filesize
380KB

Download
memory/940-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/940-49-0x00000000075A0000-0x00000000075DC000-memory.dmp

Filesize
240KB

Download
memory/940-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2772-2-0x0000000000330000-0x0000000000396000-memory.dmp

Filesize
408KB

Download
memory/2772-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2772-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2772-12-0x0000000002D80000-0x0000000002DE6000-memory.dmp

Filesize
408KB

Download
memory/2772-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download