18bc77c410322c504561cfec1e7209e7a7184e84eaa68b29e4621b8d62e03cbd

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
Size

771KB
MD5

f3e373bccb0a83c39097fb1100161ce1
SHA1

27e0bf6dd86aaaf536465054e60487bda0057930
SHA256

18bc77c410322c504561cfec1e7209e7a7184e84eaa68b29e4621b8d62e03cbd
SHA512

cdf60b936a278d6e92258abbdd5d273dc40590393f334e5f1dd9e4e68c4b8927e43b099dbc5134d2cf1bc381d55d85c58978c5b1659a2cde7fac7acaa90547d7
SSDEEP

12288:eEI7kCX+OWVzyia77BOx7x5hOIitpJNMkuRVE4clmy1Jugu741LCxHWnxX7iYomQ:BgdIWLfDw4zmvZVtvZWqEIz6qrfiTMB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1412	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1412	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1308	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1308	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1308	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
1412	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1412	1308	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe	28
PID 1308 wrote to memory of 1412	1308	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe	28
PID 1308 wrote to memory of 1412	1308	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe	28
PID 1308 wrote to memory of 1412	1308	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Filesize
771KB

MD5
949b7f20c3ae7e7f54de8374d708ec96

SHA1
bf68cb323eee631e596f2f98714e526780845bc5

SHA256
200820c336104a6920f16805614434b71bd7a50b3522eb04fde4c78bbe95b6df

SHA512
353c0e49dce4bab6543dc62cf6d8b0b9a17cbb711a2a1aca0358b3f68e11707411546b1d29aeefa202c466fd8bdfadd51e35642021f9922b79b54ea35a161d88

Download Submit
memory/1308-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1308-2-0x0000000000320000-0x0000000000386000-memory.dmp

Filesize
408KB

Download
memory/1308-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1308-14-0x0000000000390000-0x00000000003F6000-memory.dmp

Filesize
408KB

Download
memory/1308-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1412-16-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1412-18-0x0000000000390000-0x00000000003F6000-memory.dmp

Filesize
408KB

Download
memory/1412-24-0x0000000002BD0000-0x0000000002C2F000-memory.dmp

Filesize
380KB

Download
memory/1412-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1412-50-0x0000000009620000-0x000000000965C000-memory.dmp

Filesize
240KB

Download
memory/1412-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download