Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 23:45
General
-
Target
f6d49abcba95b8795e603b1174d58e79_JaffaCakes118.exe
-
Size
82KB
-
MD5
f6d49abcba95b8795e603b1174d58e79
-
SHA1
5b1df73e70961f91cfe4ccccefc7f360582a16e1
-
SHA256
7309e8759515c6204687f712e9be167dd99ac21c3c0bbcd307a619a82097f843
-
SHA512
75bc0e52069c9bfd6b1d7a9ed968ab0679a1c382c50f6eea1cf9ede39447d6074a846b95ae0e9a0b45101767dd859cd0f2506fe3c29d712aa1018021e4d2b381
-
SSDEEP
1536:yk8bL/hTSq5dEpr/hUZfM4rj/CBxV+vinBgdV6/EU4t0N0ziBzS:yk8PQthaLCHVIinMV6/EUGi0uBzS
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6d49abcba95b8795e603b1174d58e79_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6d49abcba95b8795e603b1174d58e79_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6d49abcba95b8795e603b1174d58e79_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f6d49abcba95b8795e603b1174d58e79_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5b2e855f7a3f60e13b386a8963984289a
SHA1dab95874b926584158881eb4fb4818bf08c5b757
SHA2566401bdc9c20bd22df8570dbf29e0256f24d49dee02cd966a5362cae28c80d765
SHA512105d616bcda420bd30d3dfe6128b3f2d30af333222f09440478dc6844eee665277d64a028429e3b5a845ad5c949c9a52160f13bb2d4a4442299688ea9a0b67fc
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB