9c961a3be434c2575a4cf62d98ebc5524de96d2f4ea246f4ab962bb7513447b4

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe
Size

385KB
MD5

f78a76769fa4b79c2e21e39a8209be9d
SHA1

cf64535e2cfb325404a4e6ed34a0504c122f7d8b
SHA256

9c961a3be434c2575a4cf62d98ebc5524de96d2f4ea246f4ab962bb7513447b4
SHA512

1420df7756a4d937d04208b5cf75ece6736e1873a6630f58d237d48dec35a1624a0c9e9746bc5f8c766103aecf77ae296f14dd1a05d22c50c57a4b8dd02ba5d1
SSDEEP

6144:Sy2o00RUn9p/rsze1xByPOoIf8dNfMWW81UNiucAttXB:SYinTsze1xByP44fS8Ac65B

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1980	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1980	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
11	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3892	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3892	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe
1980	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1980	3892	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe	85
PID 3892 wrote to memory of 1980	3892	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe	85
PID 3892 wrote to memory of 1980	3892	f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f78a76769fa4b79c2e21e39a8209be9d_JaffaCakes118.exe

Filesize
385KB

MD5
b8ba1f6954da24f8c3fd55e104e8a79f

SHA1
2e27fc9057731dc130473b685c58cf82e12b5011

SHA256
1d41918b16c5a746372d9ab3a7a60254607bc3f93bbb3adf366741ab8c2c10d0

SHA512
44410411f956bae91842d4fb96b0d298016a654b011d712a835e34307e2e3b3938e10f126f7b28dded26741d09f59c17984b222b5aa7d9f6d38ec818304c880e

Download Submit
memory/1980-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1980-17-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/1980-20-0x0000000004F10000-0x0000000004F6F000-memory.dmp

Filesize
380KB

Download
memory/1980-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1980-33-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1980-38-0x000000000B7C0000-0x000000000B7FC000-memory.dmp

Filesize
240KB

Download
memory/1980-39-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3892-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3892-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3892-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3892-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download