Analysis
-
max time kernel
134s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18-04-2024 19:40
General
-
Target
f8a1c3d0075443a18a95cd63c44ea921_JaffaCakes118.exe
-
Size
5.8MB
-
MD5
f8a1c3d0075443a18a95cd63c44ea921
-
SHA1
074f4bf8cc1630b32964f03b548b54a484668e15
-
SHA256
ae37e3eb795a7b6ca8aa3b7a4e6e4cf8688421b7a778aef800f292841b8f0487
-
SHA512
ccb4c8915932207e70ec59c025069d5fe8d8e95af76d7f277c007cf15325d537f4b9a7c5df13fb1983b1abd5febf648723a45403a514a10d4017fd4d251b30bb
-
SSDEEP
98304:3ULWVNkD68gnw4Po44HBUCczzM3DSEuiejkfFyu18fv4HBUCczzM3:A+Ignw4PonWCHuzYAu64WC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8a1c3d0075443a18a95cd63c44ea921_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8a1c3d0075443a18a95cd63c44ea921_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8a1c3d0075443a18a95cd63c44ea921_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f8a1c3d0075443a18a95cd63c44ea921_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD54252739a55548a3da5431ab14a6c10e3
SHA14c76fcdb8530ac3f7b5390171d4a3cb59f96c233
SHA256ee186a833eb9c7b71c53b13604bb107073e24895bfdb03b0cb7773b51efd5c3c
SHA5124307afaa9436c1cd24acd1ec854acc72f569376ebe02cf6181d29b846a00853ff9be50916ac4bbca54a01a20dd78fab76fe762e36ae981f35674ee96202d87f8
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB