df766fa95d24b85e49b4658c0bfbf88ebe506b37eaa0a111d35585a5ff46ec8c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
Size

385KB
MD5

f631c087cb1fb494ddd5f85fcb33e092
SHA1

d7ad975719521e610efcf167d3d5a17ac5b9d756
SHA256

df766fa95d24b85e49b4658c0bfbf88ebe506b37eaa0a111d35585a5ff46ec8c
SHA512

ea77be4436b34dedd1919763fe923e244f916869110d39c33d75f92112f944415a32bb8b79e7b50c941e1a26d0bdd3feeed5f30620815a0da4de49fd1b5fff44
SSDEEP

6144:8rrWjPOPGPGY5qkWyBJ35UnR6hrP0rE7A+JNY9dWIbgPufn5xt2LKOB:xvPGoP5UnRy0rE74Pbg2P5xJOB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2800	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1444	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1444	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1444	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
2800	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2800	1444	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe	28
PID 1444 wrote to memory of 2800	1444	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe	28
PID 1444 wrote to memory of 2800	1444	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe	28
PID 1444 wrote to memory of 2800	1444	f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

Filesize
385KB

MD5
63c24cf136d5b0b8b613193929572295

SHA1
64f9838ca0b6d224fb247383a89b60e997f7a53b

SHA256
adda2e66acafe1697b75bb4527d10edf5682c8827a59561a9f8bc1c0f99c9101

SHA512
66881e1abe346a0d56e5ec3db4b1c440c6efe49351cf1a357c4013ca4b3eaadc9317988fe2ccbf65810b545e9055d868ddbd78092772ed6dc34ce26027b122ae

Download Submit
memory/1444-15-0x0000000001510000-0x0000000001576000-memory.dmp

Filesize
408KB

Download
memory/1444-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1444-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1444-2-0x0000000000370000-0x00000000003D6000-memory.dmp

Filesize
408KB

Download
memory/1444-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2800-25-0x0000000000330000-0x000000000038F000-memory.dmp

Filesize
380KB

Download
memory/2800-16-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2800-17-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/2800-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2800-51-0x00000000076B0000-0x00000000076EC000-memory.dmp

Filesize
240KB

Download
memory/2800-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2800-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download