1569004b6312c84ac20c9f9c1e685317d3c108c07323cee71d203e70ad7a539e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
Size

385KB
MD5

fa24bed8b05fd25dc64e4e83d462786a
SHA1

7efe1b6f18df3ceb96725ad5b970ff43b080b53b
SHA256

1569004b6312c84ac20c9f9c1e685317d3c108c07323cee71d203e70ad7a539e
SHA512

0c1675714d291086d3de6ba1fcaa5977271ee709671b0db7ec0ec416e2dacb9e8af0c63cbcfddc8771e034bd53d322751f577de1b7f9c5b868f8c9f47033fd40
SSDEEP

6144:F4Xvi4W/K22zMkyn0ivgsS9vbNhKe3p9dr2qSpu9cc9OmWbB:y3WNkyn0i4vbr/drWwp9JWbB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1984	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1984	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1640	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1640	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1640	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
1984	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1984	1640	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1984	1640	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1984	1640	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1984	1640	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Filesize
385KB

MD5
3b4b83464b1f2f2529d48ae44fc296c3

SHA1
1965ad949a62d0dcb6e2e708bfdea4f7f45105a5

SHA256
2e5c9868dc3c68407e024f013bfb9749346b4e2bce3cbdff47de97c70f3f8810

SHA512
7e72621af4ab68945db51737d3683924d55b4c2599de377dd73fb051b1d434d02f9b2617c92f1214603e500e06189cb4e2b1ebb57b89823348afe002242bf5c8

Download Submit
memory/1640-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1640-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1640-3-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/1640-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1640-15-0x0000000002EB0000-0x0000000002F16000-memory.dmp

Filesize
408KB

Download
memory/1984-17-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1984-19-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/1984-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1984-29-0x0000000002D00000-0x0000000002D5F000-memory.dmp

Filesize
380KB

Download
memory/1984-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1984-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1984-51-0x000000000D620000-0x000000000D65C000-memory.dmp

Filesize
240KB

Download