Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17-04-2024 21:58
General
-
Target
f6a8e67dea2d9d3796f9f9f7862b0544_JaffaCakes118.exe
-
Size
105KB
-
MD5
f6a8e67dea2d9d3796f9f9f7862b0544
-
SHA1
67eeba8ade764445e3551a04fe1832ea7480f7cd
-
SHA256
5ddc8403ff377599e7b622b9c3cdaf2755244dba80eaed26318983f6b59120c0
-
SHA512
c3b4e2b41d5c23adf2fbc7a9407410b134ad8551ddb19705e5d6747100b6bde9dcf3cbddbb5e73658b4ebb354a6e3521dee718dd3625b3a59d82e0b016b2b9d3
-
SSDEEP
1536:G0nGMHIYuhaZp2KZrXVIBZW/x/AvCGrCZ3ojFXX2TXA+RxI+LbZFt0KOE1uIcKiI:GYtuaDxZ6eCCGGZ4jGk+LN3LOEOIpW9i
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6a8e67dea2d9d3796f9f9f7862b0544_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6a8e67dea2d9d3796f9f9f7862b0544_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6a8e67dea2d9d3796f9f9f7862b0544_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f6a8e67dea2d9d3796f9f9f7862b0544_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5824612ca8daac222c5c8e0a9cd6e3dba
SHA1684436cc1642013ba905ed8c0df57b851e881374
SHA256a77971efe26a18694d964309dd761e0246b29c2efb8441c3baa304496f86bd98
SHA5124b8ba8dcfa6b7b0bc10a09ee80ba3c20d44ba805b2aaf343df4c56560c3518463a1466ca5e78364ad81c74dddf36e74534cc2d6ba970e67cab24fce25419e4c5
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB