97d8ac83e093cd2ca992fbc14d47642096565ee237877aa3855e6c013a416dc8

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe
Size

907KB
MD5

fad805e794b41fc6600b9c83e6b7cf99
SHA1

a2097aaf900a228caae650d1894422d12b2dfa27
SHA256

97d8ac83e093cd2ca992fbc14d47642096565ee237877aa3855e6c013a416dc8
SHA512

31f33ce49f660ea760d4361c38102d1b87c32afea54812b3d65dfe6cb7f813cc689d5ed3a8c8f2211e3b4b5efb9b8edacc42312f6c6ebe581320a6a11e9b7334
SSDEEP

24576:T86u1vf7qtzDQlWb2l8cUIYJyAdFxNd/5MD6nejcRa/ZS1:Ap1Hup/b2hyJyAzd/5MD6nejcRgS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2560	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2656	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2656	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe
2560	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2560	2656	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe	29
PID 2656 wrote to memory of 2560	2656	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe	29
PID 2656 wrote to memory of 2560	2656	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe	29
PID 2656 wrote to memory of 2560	2656	fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fad805e794b41fc6600b9c83e6b7cf99_JaffaCakes118.exe

Filesize
907KB

MD5
6e258307894ba15ae1c0af49abd9d8bd

SHA1
2dad8f6157343e234637c965c5b115fe7bf28ad2

SHA256
1d159df5f0d9207490941637ebed1766e1c1e093d2be2b97a87633c5d8676aae

SHA512
e9a23cb5da2244b066557a6b45e17a7238e5bc3a82d5e3d67e22948c29e8bc8f773597889922abfa0b449fd1e76940bd95866eb2da5782b326bcd501522d1c50

Download Submit
memory/2560-17-0x00000000002C0000-0x00000000003A8000-memory.dmp

Filesize
928KB

Download
memory/2560-22-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2560-26-0x0000000002F70000-0x000000000302B000-memory.dmp

Filesize
748KB

Download
memory/2560-44-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2560-49-0x000000000EC10000-0x000000000ECA8000-memory.dmp

Filesize
608KB

Download
memory/2656-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2656-2-0x0000000000300000-0x00000000003E8000-memory.dmp

Filesize
928KB

Download
memory/2656-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2656-12-0x0000000003230000-0x0000000003318000-memory.dmp

Filesize
928KB

Download
memory/2656-14-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download