Analysis
-
max time kernel
91s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18-04-2024 22:22
General
-
Target
f8e006cd0a4c8b8e97a2dd1f702b02f1_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
f8e006cd0a4c8b8e97a2dd1f702b02f1
-
SHA1
c7302f55e780bc58c237660e91be397d78210f87
-
SHA256
d2ac129674994e0bab0f944da5fe20287d68f47918e2487b2dc266fddd47f944
-
SHA512
4ceebf50c451cf3c739755817c5e82355f21ebf83e96cb95dca5384b31e35d1e3bda0e53377d17c6cacdae1f8004258a7d828ef65f479b5b04840006c6c67699
-
SSDEEP
49152:VO6ipogn1BwvHdawG5N74NH5HUyNRcUsCVOzetdZJ:Vri3O9e54HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e006cd0a4c8b8e97a2dd1f702b02f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8e006cd0a4c8b8e97a2dd1f702b02f1_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8e006cd0a4c8b8e97a2dd1f702b02f1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f8e006cd0a4c8b8e97a2dd1f702b02f1_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5735a1381d0598e30c5b2c81b7c94226b
SHA11fe6c3280ad14c8d6a2940d84b064257f3feef53
SHA25632f3b53a0b6e170761d573b5ba5a20a21b45a25e519e3e6239265769e83f8f0d
SHA5125fbdced6071d5bc3ee2dcb0c60aeeaa26347263fd53c3ddde81380c3d3e126bedb322e897650bf367e4bfcd4a5a30e64a75b6fffad3bc4918d154cc94e82e203
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB