Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18/04/2024, 23:22
General
-
Target
f8fa794cdd78c2016916872f25ec867d_JaffaCakes118.exe
-
Size
5.8MB
-
MD5
f8fa794cdd78c2016916872f25ec867d
-
SHA1
55aec378c930b5bb0ccfa02ebf963d52a4377bec
-
SHA256
b6928931d988e3c28a5537794ac4d5cd1285d6363722c02fe144fdd7c8c7a2a1
-
SHA512
7af7c2ec52b70c5ca2018c514d6b08a1ddeffbc3b6ebc91b1979048325e0b1d12de2238d7dd0885877f7828a45f0df8640fb7b63f283402d6c3dc97a7248ad35
-
SSDEEP
98304:0XDIHfW9XYH6/o4HBUCczzM3H6mZb3Ui2URTXGzlnc4HBUCczzM3:0XcHfUB/3WCPl3h2nzlTWC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8fa794cdd78c2016916872f25ec867d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8fa794cdd78c2016916872f25ec867d_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8fa794cdd78c2016916872f25ec867d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f8fa794cdd78c2016916872f25ec867d_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5e52a950dc1839942adfbbd34ad0b453c
SHA1f2e730528379628b15ce6f755f064183cd13e5bc
SHA256f60cd76cc327c061d97869813e6ccad9a719970ce7f37734d9d1a6403fa49e4d
SHA51207bcb127f16823787ac524a1f84ee1c7025d47d5c2b36eb8ed0a0adc16771c1fc3f0dc75ce29b31416226528c744046a5b67e4ce60cf0c93d02c11a959f3569d
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB