f4d32aab1bec0bea9f60cfa3c7f2ccd17508f369dd2cf4f4fbea2f3234cb54db

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f34f10b912897abb41ef527410001639_JaffaCakes118.exe
Size

385KB
MD5

f34f10b912897abb41ef527410001639
SHA1

234ecda407061be266dbfb975cf1a429d80aa0d1
SHA256

f4d32aab1bec0bea9f60cfa3c7f2ccd17508f369dd2cf4f4fbea2f3234cb54db
SHA512

73f513eb9debe6fc2721e854796bda92e4ce6191d4a50fb6a192f6cffe5d67de3543186b1b42c9bb6c14a09f78bbc474e92eda804a6212f5324d8c0cd717af72
SSDEEP

6144:8zkIfawJG4iCvq1XdtzqqtKfUSejC9QPK1NSRaJIANNBCBdIISB:Z52DlvqHtz7CMlPKDCAmCtB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1960	f34f10b912897abb41ef527410001639_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1960	f34f10b912897abb41ef527410001639_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	f34f10b912897abb41ef527410001639_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1712	f34f10b912897abb41ef527410001639_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1712	f34f10b912897abb41ef527410001639_JaffaCakes118.exe
1960	f34f10b912897abb41ef527410001639_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1960	1712	f34f10b912897abb41ef527410001639_JaffaCakes118.exe	28
PID 1712 wrote to memory of 1960	1712	f34f10b912897abb41ef527410001639_JaffaCakes118.exe	28
PID 1712 wrote to memory of 1960	1712	f34f10b912897abb41ef527410001639_JaffaCakes118.exe	28
PID 1712 wrote to memory of 1960	1712	f34f10b912897abb41ef527410001639_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f34f10b912897abb41ef527410001639_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f34f10b912897abb41ef527410001639_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\f34f10b912897abb41ef527410001639_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f34f10b912897abb41ef527410001639_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f34f10b912897abb41ef527410001639_JaffaCakes118.exe

Filesize
385KB

MD5
d788c7eb4265863e903eace09019689c

SHA1
b0ca4debcee1609fc3bdf296584b7eda91eb3ae9

SHA256
d0e8a6e731f13ccec91c26806714c69c7307357197a548fd1dd508ef0f4c8917

SHA512
3242a95cb2f0694df807f487710b369bf672049ff9077c33cac142f555c52bbe290f7f805411723aa3ed29aaa58d26ab9f66b6538269f63f7a86e355ca4539ae

Download Submit
memory/1712-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1712-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1712-2-0x0000000000350000-0x00000000003B6000-memory.dmp

Filesize
408KB

Download
memory/1712-11-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1712-15-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1960-17-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/1960-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-25-0x0000000000310000-0x000000000036F000-memory.dmp

Filesize
380KB

Download
memory/1960-44-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1960-47-0x000000000D6A0000-0x000000000D6DC000-memory.dmp

Filesize
240KB

Download
memory/1960-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download