a2cff516929cbc95819b1df51c502677d40b6bff31daf63259820ac7d44197f9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe
Size

907KB
MD5

fb420b32f8b6eb113a52b01e79aa1038
SHA1

aa769c79a58120ad07175563e54f4537f40f63a6
SHA256

a2cff516929cbc95819b1df51c502677d40b6bff31daf63259820ac7d44197f9
SHA512

a0aa495a5473ce98a9d1ab2ce219cbda5e15d4f80c0a1f4eee9a529cb95a209bdcba63c646d9e3bee6edd55a8f04ace7e9e237b5f03fa096e208b8cb396b1945
SSDEEP

24576:+1T9X/tddWKTyhczhKqACw1JuOo1a/ZS1:+15FibtCso1gS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2112	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2112	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
9	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2168	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2168	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe
2112	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2112	2168	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe	88
PID 2168 wrote to memory of 2112	2168	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe	88
PID 2168 wrote to memory of 2112	2168	fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fb420b32f8b6eb113a52b01e79aa1038_JaffaCakes118.exe

Filesize
907KB

MD5
fbf3d2a619c292c0e8457682e4fc46f0

SHA1
a1ff9efa5d0b6cebe6fb13d5d2113cb6925701eb

SHA256
281d73b01111d687210431962922aa3563b73a9c693b681758cf47ab7dec58d6

SHA512
d858d74000c2079dfed41875e0b83e3f47590e2c7618e2ff9751c32cefa36f2f960da76bd53e7d002e2e586eb01cac125ef47b8e9fcac5b3d1980f5b1a670575

Download Submit
memory/2112-13-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2112-15-0x0000000001740000-0x0000000001828000-memory.dmp

Filesize
928KB

Download
memory/2112-20-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2112-23-0x0000000005080000-0x000000000513B000-memory.dmp

Filesize
748KB

Download
memory/2112-35-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2112-41-0x000000000BA20000-0x000000000BAB8000-memory.dmp

Filesize
608KB

Download
memory/2168-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2168-1-0x0000000001760000-0x0000000001848000-memory.dmp

Filesize
928KB

Download
memory/2168-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2168-12-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download