Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 22:32
General
-
Target
f6b7474694c277306211145d1c9a8160_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f6b7474694c277306211145d1c9a8160
-
SHA1
df711b5ac15a940af42b4ad4b4aad1a11ae9eceb
-
SHA256
760ea576e78b97a24d19a6af7081a97b91f0c590901b44ea456a0c7a4e8b040b
-
SHA512
8c5c470ac4a4a6794dcd242efcf7efbda454f0ed1cad94a47dffeb6e9489e3ec7bdaa5b6507785dcb7be0e62e200912fc17ad6299fc58020e4ca2ad6aaeaa5c2
-
SSDEEP
24576:QbvY3qwKfKFOGWCreWvZRs7r6jJ1NVzFUHLPni55B6kvG:QbvYM8OJMns7r6jPNTUrni5a
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6b7474694c277306211145d1c9a8160_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6b7474694c277306211145d1c9a8160_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6b7474694c277306211145d1c9a8160_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f6b7474694c277306211145d1c9a8160_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5120d2fb0e5cf5cc74f9e05cdf60f1007
SHA16f011ae28274fd20c48606e111b539df1ffd67ae
SHA256f7d1a413e7184667ab0322e59cf1cd037d11d5f406cfdf1a10db4ec94e6ab581
SHA512d59d3ee83407cb6f4540bca0083b02040b2dc3c90d96729b0af9d45ad63dd6c0151477c6f6921b30115939214e55e82736d5b52bf2ff0d1b229987d0e57a028b
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB