Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16-04-2024 10:46
General
-
Target
f35415e78bbb39d94e729bae3aaeb24d_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f35415e78bbb39d94e729bae3aaeb24d
-
SHA1
9ad7747821c280cf4d8797acd42a18bcf339af32
-
SHA256
3edf6bb61b9b6e2007d9c4b0e18d2e80e39c3f62dee53764b2113997090b62d4
-
SHA512
c68010094f03d18fc6ec02f28f1dc2b4d1ee8ca38c65f2c554f428d57b03bef01ba70ecaf362d57d683f6ed2339bd05cf6d0039ee5e1bd6daa8205d48e720dcf
-
SSDEEP
24576:Usx4TqkkPHSVb2Z680w3Ms140DugBrnXPb45OKKpPvG:XWqkkPyQw80kMsailTCOLp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f35415e78bbb39d94e729bae3aaeb24d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f35415e78bbb39d94e729bae3aaeb24d_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f35415e78bbb39d94e729bae3aaeb24d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f35415e78bbb39d94e729bae3aaeb24d_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f816dbf3acbadff0de27e8dbdada2a5a
SHA1fa706ade1860ffcbce0c3239b7c29e15f4f8d6f0
SHA25680e96e6cf9c4eea1bdfdb7c53d05efb53f2aeb5950c286979786b0b24b80fef3
SHA512f1aba0f730b049f67b58a75b4028b81b0fd126d2f36c44777e0a0aa14461e930d0c886051a3b8d743bee5ca1ef1209f3666f215d16176834f8c006d1579a222c
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB