Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19/04/2024, 04:19
General
-
Target
f97d12748cc1d615b3591b208f542e47_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
f97d12748cc1d615b3591b208f542e47
-
SHA1
90f04a8cb7d66597db545735bb579d36c54b093c
-
SHA256
d7995476565a27a9843e7bff47e5b46583feed863553fefe9bf9cff5b99d1af0
-
SHA512
d2375d905c934e49648abb1a55af44c859f7627b37a640008833421a9920e60c85c5f0d0d90f54d8e97f57f0b1d349577c17c58146be393ef14bc118a8279863
-
SSDEEP
24576:hjNCR/qNpf1qwD60nLP6daFYnZQUfufbDMxG2bX5+W:QCNzqo6MLiLZxmDDgbXE
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f97d12748cc1d615b3591b208f542e47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f97d12748cc1d615b3591b208f542e47_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f97d12748cc1d615b3591b208f542e47_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f97d12748cc1d615b3591b208f542e47_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f47ec80794633b6d7cf2fed36813dfe1
SHA15020306f215ebfef21a8b06a7459bc2e13976a7b
SHA256a5b0ee8cd3b8ae08211d9d83db05a10429fb5919c6379b990145b71faf83ff12
SHA51230b6d2a71f21766f880db93ce94fd231dedbf51de16ab93b142fe70c320a8a946fb433d2e5f7298e87ecbf77ee29175169e4d905f2d7cc59af0bec804a3a7bcf
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB