Analysis
-
max time kernel
90s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16-04-2024 08:23
General
-
Target
f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
f3151cb79fac2ee3243d17b838564766
-
SHA1
fe43b0487764e95573f60be62c31da3ccceba257
-
SHA256
1ae7efb121e6171be290820095b9fedcef7a7a99d871eba3dcd856f1b6bd5c16
-
SHA512
06926e39c227c7a81a525aa4fe4ede2ba21988c5f5317666c1ba4ec00b0bbf5588b3e83a8ba027a51484604516ca58e5780798c38b13615aa1c6879f0bbdd44c
-
SSDEEP
24576:oNRL/Ygb9CzJkTrTg8L6+OQum2bczfCmO3TrMgnrj/5RW:ovUgbykTrTg8LZOQcmGTrj/j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f3151cb79fac2ee3243d17b838564766_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5a3772813072d742dd8429cb987ae7e87
SHA1cf10a877f4a33a2fe126e31a8d119ba80a554f73
SHA256428a5c14f9de94df82c08ccd4da3081a8c65152e0e247f3cd7d39aa838ae8b0f
SHA5120d854ec3849d68b992df6e85e0ae88c813627e89c01f107bda107950d45761b41eb2e16eb53393ad560a559950703237b892f7106b09f7c686b0b554aa3c76fa
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB