1569004b6312c84ac20c9f9c1e685317d3c108c07323cee71d203e70ad7a539e

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
Size

385KB
MD5

fa24bed8b05fd25dc64e4e83d462786a
SHA1

7efe1b6f18df3ceb96725ad5b970ff43b080b53b
SHA256

1569004b6312c84ac20c9f9c1e685317d3c108c07323cee71d203e70ad7a539e
SHA512

0c1675714d291086d3de6ba1fcaa5977271ee709671b0db7ec0ec416e2dacb9e8af0c63cbcfddc8771e034bd53d322751f577de1b7f9c5b868f8c9f47033fd40
SSDEEP

6144:F4Xvi4W/K22zMkyn0ivgsS9vbNhKe3p9dr2qSpu9cc9OmWbB:y3WNkyn0i4vbr/drWwp9JWbB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4172	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4172	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
16	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4440	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4440	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
4172	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4172	4440	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe	91
PID 4440 wrote to memory of 4172	4440	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe	91
PID 4440 wrote to memory of 4172	4440	fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fa24bed8b05fd25dc64e4e83d462786a_JaffaCakes118.exe

Filesize
385KB

MD5
89f4d36d2b4f66185367059bd4370fe6

SHA1
9d3061b48a4bc10849d3d4edc8e8d50c2fe3f513

SHA256
f7647b6c51f4b5050046924bfdf732d38c92dbbea2ada022543c08055830a1fd

SHA512
7fe4076228f295fd8a63f4b9e7ac57c3626c5cf0aee3bb91a3f63a886006556c9ff57452ea08903a28b762f5189386fd3954e1908f988b33f2065690b062e351

Download Submit
memory/4172-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4172-14-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/4172-20-0x00000000015D0000-0x000000000162F000-memory.dmp

Filesize
380KB

Download
memory/4172-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4172-33-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4172-36-0x000000000C800000-0x000000000C83C000-memory.dmp

Filesize
240KB

Download
memory/4172-39-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4440-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4440-1-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4440-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4440-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download