Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 12:15

General

  • Target

    f379bda1c543a24c8c92b97ffea1ac92_JaffaCakes118.exe

  • Size

    133KB

  • MD5

    f379bda1c543a24c8c92b97ffea1ac92

  • SHA1

    5628f390ebe96594a6bc289a3d12d37c46819a67

  • SHA256

    5ce43b4937cb590e2e9b1636f7ab915ac1c420f2e59374b68555c96cc77d852c

  • SHA512

    9246f578bf92285e40641c03a5eefc2da9c7e5b113231c62a91dfd40825e639b36743ccb3cddae94aa2f01daadce663c6800b0ecb9aedfc27f2654c020d4b13f

  • SSDEEP

    3072:TYYhy4W8P7S2M/ZKdLSTIIXw7uAhzwIBkRxOwexgLFQOV5Q:TY34Wl/ZK18IIXwHhnBkRULgXPQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f379bda1c543a24c8c92b97ffea1ac92_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f379bda1c543a24c8c92b97ffea1ac92_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\f379bda1c543a24c8c92b97ffea1ac92_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f379bda1c543a24c8c92b97ffea1ac92_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f379bda1c543a24c8c92b97ffea1ac92_JaffaCakes118.exe

    Filesize

    133KB

    MD5

    4315883732aba5f76de3becd3d6bb304

    SHA1

    642d3a9a741330ad1423662126c3f1b658a7b8a0

    SHA256

    f8c3cbd200069e3b275d34ce9ea709c2a2cbae8c24cc5991fbefeb19c663e012

    SHA512

    426b14f7b102998168c8852be7d72f97bff130b852209c7009012d7af1ac554f14a17e900eaee3094001c553505c761fbc03bd8f3d3d6db832960cf3aac81df4

  • memory/2688-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2688-1-0x00000000001D0000-0x00000000001F1000-memory.dmp

    Filesize

    132KB

  • memory/2688-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2688-13-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4892-14-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4892-15-0x00000000001C0000-0x00000000001E1000-memory.dmp

    Filesize

    132KB

  • memory/4892-16-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4892-32-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB