d93e7236a215ce84ac5b5943e5d499c329c5ef7664caac829f3aca8cc5475ef3

Analysis

max time kernel
94s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe
Size

907KB
MD5

f5cc5d3f995f330debd763cdd19ca5bf
SHA1

4b48afba252869b435713a720810f067afb47408
SHA256

d93e7236a215ce84ac5b5943e5d499c329c5ef7664caac829f3aca8cc5475ef3
SHA512

324963d728f3bcefd6040067f178dc216b8af1d325c2e94ddf76e39a106bea01b45c7590738bde79d9933a504854384690fb5a8ac398f3cc9c899d1b7108344d
SSDEEP

12288:Vz0BdxPZMWz+oFo9n9pn4YoEji7uTI6CMXo6TgMLfhwgzXjGzCjVDa/ZS1:VABf6WioOnEewuT7XoZMZXa/ZS1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3284	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3284	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	pastebin.com
10	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1604	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1604	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe
3284	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 3284	1604	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe	87
PID 1604 wrote to memory of 3284	1604	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe	87
PID 1604 wrote to memory of 3284	1604	f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f5cc5d3f995f330debd763cdd19ca5bf_JaffaCakes118.exe

Filesize
907KB

MD5
f8b30e5618cc44a4c835ca546cbafa91

SHA1
f38c36110d06f84b150ef45d27426f6caf75f34f

SHA256
fe065f5e9e72ac881ad97d0420a60933e8e1a64c25f8dd1414fe4e6352bb3a3d

SHA512
11f87507d8e23ba0cfb4b56f19472224ea1c2cb6d6c26901aa47a3aa4a02845f1b4ab0e4d60eaf0c15d49a19096fb05ad9dec6dc96a70ad01c12f1ce4e3cb633

Download Submit
memory/1604-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1604-1-0x00000000015B0000-0x0000000001698000-memory.dmp

Filesize
928KB

Download
memory/1604-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1604-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3284-14-0x00000000015B0000-0x0000000001698000-memory.dmp

Filesize
928KB

Download
memory/3284-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3284-21-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3284-20-0x00000000051A0000-0x000000000525B000-memory.dmp

Filesize
748KB

Download
memory/3284-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3284-36-0x000000000B9C0000-0x000000000BA58000-memory.dmp

Filesize
608KB

Download