Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17/04/2024, 02:22
General
-
Target
f4d48701646bf5ad075ae7c19e4f3279_JaffaCakes118.exe
-
Size
82KB
-
MD5
f4d48701646bf5ad075ae7c19e4f3279
-
SHA1
c1e31d3b2610423e69402a299528d1b3ed89e514
-
SHA256
f8bcab4b8b3d777749b19878cafafa2d86b3446e1b79552e7ccdd7fbe7e761fe
-
SHA512
63a495cb0fcb4d41eaa576c17a059b5e5cca0cdb6123786c2ced47c86dc5e97b3076df2171c90a81a7fb7768e62470a450c7db18ab2f4e7365dfa84225692a89
-
SSDEEP
1536:O5yIJpcZ0e4e679IxGmwt4Hm5mtUxJ7FK73v8FPTpQ8KXWnbspWQKI:QT0w9P6ZUjG89ddKGnYkQ3
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4d48701646bf5ad075ae7c19e4f3279_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f4d48701646bf5ad075ae7c19e4f3279_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f4d48701646bf5ad075ae7c19e4f3279_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f4d48701646bf5ad075ae7c19e4f3279_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD546ba732b1fc1806ef86fb2eb7291df42
SHA15de70d18f12133d31e4d55946cd2731748eb835a
SHA2561ff0ee51417fe8395c0db3ba34c7c94e2e9a2623de5f5efd6516575ae12f8a04
SHA512535eff1b575cc422c30675e203032708450bfe37b816cdafb6bd2690bebd5e54f00dda3a0afefc0394702b11f9612324c28c2de468dfc1f47b64ed01ba734636
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB