Analysis
-
max time kernel
122s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17/04/2024, 14:58
General
-
Target
f609e59cb67a644a9fba21a13d071386_JaffaCakes118.exe
-
Size
169KB
-
MD5
f609e59cb67a644a9fba21a13d071386
-
SHA1
da179fb5ae06cf4fd92dce0c52df127066ca6975
-
SHA256
cb4109fc299489fb5b26eff09f2c7e96a9614c5ceae0010750732ca3902b1118
-
SHA512
ae5099f73b1cc647cc3bcc6fe839423fef0848ff78b8ea6b51689e6937d9cee1b92b9c3717a5d9c2f09c38581a8cd6e65e433870bfe844a673da5363a5d8b7f6
-
SSDEEP
3072:2nIPTOsf7n3jorQ98yb6/gYJnypW9sz3GXZo0scMqF2DeP3mLPx1Ih:2nwOW3cO82AyY23GJo0scxFQ43APvq
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f609e59cb67a644a9fba21a13d071386_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f609e59cb67a644a9fba21a13d071386_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f609e59cb67a644a9fba21a13d071386_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f609e59cb67a644a9fba21a13d071386_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5be3821623a792dbc1295661690650a29
SHA15b3fe626eb4060dfb47add1a49bbfeb29a280319
SHA256b1d373a8372f69de7c6a118924d8786ef60c27ca886737c4e3691dc11927f3fb
SHA512b86737d44637bb4e2c58f55421383509877e4aec948d6ebbbc7dd41190db8a8c6608584faf981aab6a45a6929ce0154906b45ee599de99aaa1ad758a48ea260e
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB