9c71bb9009e94932ba6d70c65e91dd43646654a3b313cd48473ba6d59a6b37ba

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe
Size

907KB
MD5

f3bc33996dbb3b374df50bcaa970969f
SHA1

dabcf1a3c62d32aff0f9c98381fad4619dab1698
SHA256

9c71bb9009e94932ba6d70c65e91dd43646654a3b313cd48473ba6d59a6b37ba
SHA512

f24768ee19552e1b282bd02cd88bdc3c93d69352c97a48cc5a4c9cdf11ecea7efaa26af92a00044277268ffdd33bf33a16e30a8b9a1d0f9d43b098070d04bd33
SSDEEP

24576:VW9sRuQOVHCYNta7CrjOj9eyBWCyCgzbPG0Tra/ZS1:w2miYN7rKBeyBWdCgzbPGwgS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2252	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2252	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2168	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2168	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2168	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe
2252	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2252	2168	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2252	2168	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2252	2168	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2252	2168	f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f3bc33996dbb3b374df50bcaa970969f_JaffaCakes118.exe

Filesize
907KB

MD5
91d250cafdebc9dc84d9206b0fa64e5a

SHA1
4605732faf691d015012f6f4d23e16ed2461cc02

SHA256
1153e7f48455644e4b4e177086cf44c1ab84eeb91ded4d59239418fb838c4193

SHA512
8df3a02046181590e3399c8465dcc9db9f6bcd72c34cf0b63431b1bd3a77c3a893f67f0af13f258a4df6da33135dafcda0bcda663028a0b33353d7d0076b0e3e

Download Submit
memory/2168-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2168-2-0x0000000000280000-0x0000000000368000-memory.dmp

Filesize
928KB

Download
memory/2168-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2168-12-0x0000000003300000-0x00000000033E8000-memory.dmp

Filesize
928KB

Download
memory/2168-14-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2252-17-0x00000000014F0000-0x00000000015D8000-memory.dmp

Filesize
928KB

Download
memory/2252-23-0x0000000002ED0000-0x0000000002F8B000-memory.dmp

Filesize
748KB

Download
memory/2252-22-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2252-44-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2252-45-0x000000000EC30000-0x000000000ECC8000-memory.dmp

Filesize
608KB

Download