31d5d25096edfc92a96c2655ecd0993d940b375b0f3b08d799c0726a1d541701

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe
Size

385KB
MD5

f89a04076b5aedef3250eb6c249f7a15
SHA1

20902406d2c3f5cf6f06fb3ca4b21a5288e023cc
SHA256

31d5d25096edfc92a96c2655ecd0993d940b375b0f3b08d799c0726a1d541701
SHA512

4993fa01ad9133138ae4ceb4f4083bfc4c75b1917e69400ab7043604b4548fed241b6c505d693093bbaba91bbe9fa369dd36d8592d0d1f59fbc3b981afe04779
SSDEEP

6144:4xO4GclbaTgFbAPfjzBACx3RsdJpL390i+mGj+/YeHcBahPHsB:4/GclbasqAYsvJ90iXG6YeHcBahkB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
396	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
396	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com
10	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2488	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2488	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe
396	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 396	2488	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe	88
PID 2488 wrote to memory of 396	2488	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe	88
PID 2488 wrote to memory of 396	2488	f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f89a04076b5aedef3250eb6c249f7a15_JaffaCakes118.exe

Filesize
385KB

MD5
ef6e7f08288564332e68d54a3fe1dcc5

SHA1
80eb8115fc263f93dcdbc1f9f4f944c83a7a0543

SHA256
001d46c75415009fde9c81a88b37a8480c76fd3ebf98bb0885f8a719ef8da074

SHA512
a2a933259869ff9cd834c9764e94d977a5a500f1dd47bb214d71dded427f41e9078280330fddf8bffdb16fee6365390373021ed88b0c4fa958ab9374d5133afb

Download Submit
memory/396-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/396-15-0x00000000015A0000-0x0000000001606000-memory.dmp

Filesize
408KB

Download
memory/396-20-0x0000000004E90000-0x0000000004EEF000-memory.dmp

Filesize
380KB

Download
memory/396-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/396-33-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/396-38-0x000000000B7B0000-0x000000000B7EC000-memory.dmp

Filesize
240KB

Download
memory/396-39-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2488-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2488-1-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2488-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2488-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download