Overview

overview

7

Static

static

7

f41e23b934...18.exe

windows7-x64

7

f41e23b934...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 18:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f41e23b9345d4a24054495a857f456ef_JaffaCakes118.exe

  • Size

    2.7MB

  • MD5

    f41e23b9345d4a24054495a857f456ef

  • SHA1

    9492bdaa1852546cef01b8df79715696d25c9acc

  • SHA256

    0e308c2c82bf47fef7b15dbba75c962af1a188159f938bdb457b206005a09751

  • SHA512

    a91cc2accf7a0fd49a4b9a94be14f9cc09f95c10b5b3a8b5889b3a60102a165e9d642ff9cd1d9967939d7746969696fcbde78dfa7221104664ff3afc09fae916

  • SSDEEP

    49152:/PopIY2dfRYq2lAAFiUCJs+9KKAXtsI7hidahJQl6R7HQYzKf0jliaFD2hdUTp:HLY2dpgOWMqxhid48YMYzo0jlLSXUTp

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f41e23b9345d4a24054495a857f456ef_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f41e23b9345d4a24054495a857f456ef_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\f41e23b9345d4a24054495a857f456ef_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f41e23b9345d4a24054495a857f456ef_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f41e23b9345d4a24054495a857f456ef_JaffaCakes118.exe
    Filesize

    2.7MB

    MD5

    fcb0b0dfe0675d9352212a7e41e98a5c

    SHA1

    a661b4629e7237139d24b1e930921f9afb76d163

    SHA256

    a81e1ccfba8e6f8192fb85cf89ecfb5309da3a97805ccd6c6ef9a64426b2a0eb

    SHA512

    c050e648dff313e2cb3d6a0b7d114101a959473903a22ad075a0923ae296da1707e4d294ac52034dd2ac881fd90d432c2bb45d815f8302d1f4226371392b5d4a

    Download Submit

  • memory/2988-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/2988-1-0x0000000001C40000-0x0000000001D73000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2988-2-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2988-12-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/3888-13-0x0000000001D50000-0x0000000001E83000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3888-14-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/3888-15-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/3888-21-0x0000000005650000-0x000000000587A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/3888-20-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3888-42-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download