7d5aed86c90655e28845501372db50a571743a929a221170583dc2b8906b9af1

Analysis

max time kernel
135s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe
Size

771KB
MD5

f74d89fab10451dc8775f2e396bb39bb
SHA1

5a829fc740fb522abd9fd157b25e1ccd0be0e0d3
SHA256

7d5aed86c90655e28845501372db50a571743a929a221170583dc2b8906b9af1
SHA512

06783c9441d216ba031dc2debbe4c8e092fce407651dff0e844955d425023be09943b6e75ef5b8c866247ea1633b1635a8be6e4b3781d0ef5a88a621562b5e4f
SSDEEP

12288:B9PCuaqXlr18vBSwhw9iL4192gvb10VHmDXTuFaa2AtyGTKOF25ZoJJyhRge8BpB:B9PCzQ8ZfKp19Hb10hJaothZ2/T6FBBB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
636	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
636	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	pastebin.com
8	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
332	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
332	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe
636	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 636	332	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe	92
PID 332 wrote to memory of 636	332	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe	92
PID 332 wrote to memory of 636	332	f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332
- C:\Users\Admin\AppData\Local\Temp\f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f74d89fab10451dc8775f2e396bb39bb_JaffaCakes118.exe

Filesize
771KB

MD5
71343cdc8104c6fda5f5b6177801a4fc

SHA1
5cbdcf7c468262b9bae7eb63015c6734ad5698ec

SHA256
d4ae4ac39b520a6c71108874761dde27ca708adf1c60e067e083ba1b04d44fbb

SHA512
1c349f0ddb6784e796609259df6d6a63d0b96659cfdb05c52cf9bb548d188a7167e37f2776052fb1a64296cba71d49a68d90c0a0d8bda43f2c8629f4d9cff286

Download Submit
memory/332-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/332-1-0x0000000000150000-0x00000000001B6000-memory.dmp

Filesize
408KB

Download
memory/332-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/332-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/636-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/636-14-0x0000000000180000-0x00000000001E6000-memory.dmp

Filesize
408KB

Download
memory/636-20-0x0000000004EA0000-0x0000000004EFF000-memory.dmp

Filesize
380KB

Download
memory/636-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/636-36-0x000000000B870000-0x000000000B8AC000-memory.dmp

Filesize
240KB

Download
memory/636-33-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/636-39-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download