Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17/04/2024, 00:08
General
-
Target
f4a08653aa99d02561bc980215d6d530_JaffaCakes118.exe
-
Size
82KB
-
MD5
f4a08653aa99d02561bc980215d6d530
-
SHA1
574756fef6d7c0a205b585ea7d673b463ed7803f
-
SHA256
ff0a94040c14b9e4dc27dacc7eaf9350961a53372bd5aa566a79d923996b5f59
-
SHA512
4b332829542c2fb65eecfe8a0be0d1780addf488c7f452c8c2809a99e61b864d511e668f7368f17ad12dbbaff072a28a179ec1b76c04611c634d3b3dc11add1c
-
SSDEEP
1536:mKZ1chuEytJy/YO8/kEduK433PrvuKsxhcDfmfnRGLPE8Zk61nZwJnqDJICqBjRy:Lce4Z8IBHecDrc8hZwJnqNICqZO
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4a08653aa99d02561bc980215d6d530_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f4a08653aa99d02561bc980215d6d530_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f4a08653aa99d02561bc980215d6d530_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f4a08653aa99d02561bc980215d6d530_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5f127597792c3ab1d2ac9cdf731a73e79
SHA12744e0be163cf92e30ca8f644d25bfe0856dbfad
SHA25698e3ff4b6fb6e9083e2a19d9585251cf42efbed8053addc318635d66ca277c28
SHA51287eb5ce2ba8389de6d034d1b52aa7eb36251038f46922252c41f04546e167756effdf70f4a8dbcf026b8b79e31e101118437bb0e1bea1bdafa69520d3094396e
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB