Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/04/2024, 11:58
General
-
Target
fa3f96b9cafab0ff3aee636b3bb79e13_JaffaCakes118.exe
-
Size
84KB
-
MD5
fa3f96b9cafab0ff3aee636b3bb79e13
-
SHA1
04dd8275e2d05c984f509f7bbb01360e12161a91
-
SHA256
826ea2ff6c425c21ce3b57eb95b5c99ab8e626728e16cc50c42a62e4f6108626
-
SHA512
586b236b6d0c9b9917479632eec3d57b16a95cd36d995acacd4670eacc651517386cfdf8de9e6be9bf7ada95b023c456ed39ab075903d26544c330fbf87fb425
-
SSDEEP
1536:LL3xzCC9PtyxmujFVM4442P5/HqGTG1LZfZc9Tk2ZjUF3Lgn1L45gEjms:LYCqIupy42FPyLZfO9IijUgnS5gEjms
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa3f96b9cafab0ff3aee636b3bb79e13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa3f96b9cafab0ff3aee636b3bb79e13_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fa3f96b9cafab0ff3aee636b3bb79e13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fa3f96b9cafab0ff3aee636b3bb79e13_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5009f1afbf9c83a699aaf61354bdcb2cb
SHA18768c14db5403626d7b41e9b6fa9cf83e8624895
SHA256bb1408fb09d7ab4907c7e67c0b9289b59bf0ec85dbf95fb09717d9e26dcb2a88
SHA512a93718e44951f7540d9b47c7e5cca532988699d709b845bde86bacf1125467f1ed1ec7562e5862c55b6e94325093f9504c1cab2cd86d2f17b0cdd8ef14cfd52a
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB