283451b3d8cb54269e70f77665414899c7c6fa6cc14899f2659b841cd24a5a80

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
Size

771KB
MD5

fa45d307be36d1e6d37c9037a17275f7
SHA1

ec9eec5d2a3984b221bd6296f079c1fb7d60576a
SHA256

283451b3d8cb54269e70f77665414899c7c6fa6cc14899f2659b841cd24a5a80
SHA512

bd5814770bd546789c742ff2d77561915ec7703f4b959c2e450417f531fb17778bb0e5b325f55d3ecdba198785edcf46b5ffd863448ff03b4f41f872d67d8353
SSDEEP

24576:LsMovkgmhcoDVhKb4ub10hJaothZ2/T6FBBB:gjcgRoD/yD/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3032	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3032	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1776	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1776	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1776	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
3032	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 3032	1776	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe	28
PID 1776 wrote to memory of 3032	1776	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe	28
PID 1776 wrote to memory of 3032	1776	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe	28
PID 1776 wrote to memory of 3032	1776	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Filesize
771KB

MD5
34bdda518e0813e8b6b98ce0c71b2dcd

SHA1
b8d62d7d6b35ed79275b497ee273db3f71f51279

SHA256
38df7c6a7d8e82e4876ed95261c5c5a5c904f40e14f9108df4d8fe4cb40d73af

SHA512
32353c532e57830029597e0701d35cfd6361f88f2feb592c0237702e4dcb44573031b1c44434a84ac21f4ab3136b40c1ef53850f64c1fcc4fe3a2b6473147cb4

Download Submit
memory/1776-12-0x0000000000290000-0x00000000002F6000-memory.dmp

Filesize
408KB

Download
memory/1776-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1776-2-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/1776-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1776-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3032-17-0x0000000000360000-0x00000000003C6000-memory.dmp

Filesize
408KB

Download
memory/3032-20-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3032-23-0x0000000002CD0000-0x0000000002D2F000-memory.dmp

Filesize
380KB

Download
memory/3032-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3032-48-0x00000000075C0000-0x00000000075FC000-memory.dmp

Filesize
240KB

Download
memory/3032-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download