5ccca889b91918e57eaca60240ff5efc90aa2d3253e2913c78f1d3df8aa2b223

Analysis

max time kernel
147s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe
Size

506KB
MD5

f854fa12f7169800382bd8f368db4631
SHA1

6d8a0d0f51e7eae50c0dfef1c774ffeb2c743540
SHA256

5ccca889b91918e57eaca60240ff5efc90aa2d3253e2913c78f1d3df8aa2b223
SHA512

40c74bea15de524191d375ddaf66253f7871796d68c836ade25791a0e46a60cf3eb9659f69734e168a76bb29654766ec0ef47db981b35728416a253b874df6b6
SSDEEP

12288:2UBkXyZJao6faEIdhlb1rR7d7ioHTLIlgpAGxS:2AkIIyhlbNFdWoHPIws

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
17	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe
3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3932	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3932	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe
3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3420	3932	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe	84
PID 3932 wrote to memory of 3420	3932	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe	84
PID 3932 wrote to memory of 3420	3932	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe	84
PID 3420 wrote to memory of 2608	3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe	87
PID 3420 wrote to memory of 2608	3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe	87
PID 3420 wrote to memory of 2608	3420	f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe" /TN Google_Trk_Updater /F
    3⤵
    - Creates scheduled task(s)
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f854fa12f7169800382bd8f368db4631_JaffaCakes118.exe

Filesize
506KB

MD5
6521aee08caab75368061805402c2065

SHA1
8cc1a37f3de90801c79cde2dd860d65abdfcd47f

SHA256
de782c5acfb2e3f9a66a6da95e74959269adfc71e7e78a4afe0570f4a579567a

SHA512
574a129c8a0b00ef2c62cb6f3d596b0866ec2bcbddcc2c4ce4d515c19d3ba46a7781d37da798e7f9c315ed16cf77e5655463c406e704ddcf3e314d146577efe5

Download Submit
memory/3420-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3420-15-0x0000000001510000-0x0000000001593000-memory.dmp

Filesize
524KB

Download
memory/3420-20-0x0000000004FE0000-0x000000000505E000-memory.dmp

Filesize
504KB

Download
memory/3420-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3420-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3932-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3932-1-0x0000000001660000-0x00000000016E3000-memory.dmp

Filesize
524KB

Download
memory/3932-2-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3932-11-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download