18bc77c410322c504561cfec1e7209e7a7184e84eaa68b29e4621b8d62e03cbd

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
Size

771KB
MD5

f3e373bccb0a83c39097fb1100161ce1
SHA1

27e0bf6dd86aaaf536465054e60487bda0057930
SHA256

18bc77c410322c504561cfec1e7209e7a7184e84eaa68b29e4621b8d62e03cbd
SHA512

cdf60b936a278d6e92258abbdd5d273dc40590393f334e5f1dd9e4e68c4b8927e43b099dbc5134d2cf1bc381d55d85c58978c5b1659a2cde7fac7acaa90547d7
SSDEEP

12288:eEI7kCX+OWVzyia77BOx7x5hOIitpJNMkuRVE4clmy1Jugu741LCxHWnxX7iYomQ:BgdIWLfDw4zmvZVtvZWqEIz6qrfiTMB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4564	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4564	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
13	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
556	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
556	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
4564	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4564	556	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe	86
PID 556 wrote to memory of 4564	556	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe	86
PID 556 wrote to memory of 4564	556	f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f3e373bccb0a83c39097fb1100161ce1_JaffaCakes118.exe

Filesize
771KB

MD5
b9b9d36eccd436bd3a6af2bff5a86741

SHA1
f30f5bfde8a82db7f56fdb63f1a514dfb2540699

SHA256
d20f11ad4600e66e2cae682c616f8b20ef3d4f64589029affd8f5ce141203cc1

SHA512
1db711e434076d00b78b255003166eafa223c913817f54369b42f1c947dbf160c9eb9d0aadb76889bf10835ec699f3147bb0956c9954f36fb467b8ede1598538

Download Submit
memory/556-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/556-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/556-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/556-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4564-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4564-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4564-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4564-20-0x0000000004F00000-0x0000000004F5F000-memory.dmp

Filesize
380KB

Download
memory/4564-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4564-37-0x000000000C820000-0x000000000C85C000-memory.dmp

Filesize
240KB

Download
memory/4564-41-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download