Analysis
-
max time kernel
121s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe
-
Size
385KB
-
MD5
f6cb44036866b96730253b3ef835c9f6
-
SHA1
fd6fc0f944c5c1e02ee5736948cc7f35862e50ed
-
SHA256
3bcf6746802b82a8138522fce58187505193bf704a7305cefd91d5084263d517
-
SHA512
9a73e9526f015570957bed051a77d6b08949c635047debd1354f8e4442e580c67017e419b05c5d7a6951d16cb39a3b8074d88c7459f2dff8ad79fe9479ae696a
-
SSDEEP
6144:fofjbs2nUP4/j5tjZIw4B6Ec3kCAgyCNYQyS/dG/tzx33zwpWlk+at+ZZH1pxB:fso2nUgb5RZNUFq/dGfz5JZHlB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4340 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4340 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 34 pastebin.com 36 pastebin.com -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3612 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3612 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe 4340 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3612 wrote to memory of 4340 3612 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe 94 PID 3612 wrote to memory of 4340 3612 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe 94 PID 3612 wrote to memory of 4340 3612 f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f6cb44036866b96730253b3ef835c9f6_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5dec6a4353ae583f60538b3305663e0b1
SHA1e54fc1ed61673c55b56cf460206b820400f64d23
SHA256a836e003050337a79d7317e9fcbcf5d26b3cfb4dc89a3ca52ddb22bd09bce5c6
SHA512c78e23351833b2fa00a65c65916d2832f0fb342e52f457820acddb8ac69c0d102f9cef84a9825ae2c1a324425f98c8d0b0f523b062a41372ecd993ed0d13d8eb