b56d6a73f712ee3dbcf1d1004a08cc90fdd3d8175e43de45eacc0646586e20e9

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe
Size

385KB
MD5

f77355e43af3d2befc6b5134915d6384
SHA1

c1014f30eb1de3dd64ef356b65ef18f6a29b8e0a
SHA256

b56d6a73f712ee3dbcf1d1004a08cc90fdd3d8175e43de45eacc0646586e20e9
SHA512

f19cba4cc729bf7934e9e4c5970a708e9cdfa818453afcedfe7f9f12d5eb04e2aa3c77f2e16a958bbfa29566af927166af7a31c849baa0b0a88e97892a11286e
SSDEEP

6144:+Q5CFr+OeSnhhxb1fatWMzJSN+DQ+hlVWx6lRvTRDlKr/3F8mFyQV8k0NmHkNq+B:NCFrmShhpUWSK+DQDIlRGT18DmENq+B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4192	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4192	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
11	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1500	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1500	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe
4192	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4192	1500	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe	84
PID 1500 wrote to memory of 4192	1500	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe	84
PID 1500 wrote to memory of 4192	1500	f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f77355e43af3d2befc6b5134915d6384_JaffaCakes118.exe

Filesize
385KB

MD5
004d83af74b7d5ba3c0b1848c20d4f54

SHA1
795a8139f2f0486de50d0c3b5c9c9f714e6440f5

SHA256
829f30960e408e5ba5a27cbe5fbd9a992563eab31750a8166304281ad0fe7b6b

SHA512
6f1494f4f16472ef8075279ce4fee47ea0b01b36e0cac15a5c390b9fcbe5d25deb2f9479e6685a96d4305fd680b5e0f4d01db5ed58c3e8e7c9e81ea0f6fb4301

Download Submit
memory/1500-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1500-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/1500-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1500-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4192-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4192-15-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/4192-20-0x00000000015E0000-0x000000000163F000-memory.dmp

Filesize
380KB

Download
memory/4192-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4192-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4192-38-0x000000000C7E0000-0x000000000C81C000-memory.dmp

Filesize
240KB

Download
memory/4192-41-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download