283451b3d8cb54269e70f77665414899c7c6fa6cc14899f2659b841cd24a5a80

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
Size

771KB
MD5

fa45d307be36d1e6d37c9037a17275f7
SHA1

ec9eec5d2a3984b221bd6296f079c1fb7d60576a
SHA256

283451b3d8cb54269e70f77665414899c7c6fa6cc14899f2659b841cd24a5a80
SHA512

bd5814770bd546789c742ff2d77561915ec7703f4b959c2e450417f531fb17778bb0e5b325f55d3ecdba198785edcf46b5ffd863448ff03b4f41f872d67d8353
SSDEEP

24576:LsMovkgmhcoDVhKb4ub10hJaothZ2/T6FBBB:gjcgRoD/yD/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3300	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3300	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	pastebin.com
6	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1404	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1404	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
3300	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3300	1404	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe	86
PID 1404 wrote to memory of 3300	1404	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe	86
PID 1404 wrote to memory of 3300	1404	fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fa45d307be36d1e6d37c9037a17275f7_JaffaCakes118.exe

Filesize
771KB

MD5
4c0e7576d946f380dbeaf03e53d020b5

SHA1
072ed0088d74745c37699de987bf154b2ae138b3

SHA256
93a347add0d7cc0fa4738ef98bf0ca32daec03025a449f6d4dc0290b6ef96658

SHA512
20b078c6fc900ed74ced950acb38fe565d2c384426d0e35481892afe42d30f01e5b935c33afa190f5df398bfe0ca0bf63c7acdac46dcb50f8003fef3a01da565

Download Submit
memory/1404-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1404-1-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/1404-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1404-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3300-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3300-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3300-20-0x0000000004EB0000-0x0000000004F0F000-memory.dmp

Filesize
380KB

Download
memory/3300-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3300-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3300-41-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3300-40-0x000000000C7E0000-0x000000000C81C000-memory.dmp

Filesize
240KB

Download