2c3a9222f6386a5910e372870adc01e93446891f066078f16461322339f38a32

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe
Size

771KB
MD5

fbd7a806b1d659ab97694a2dc84ca688
SHA1

d2f52a48c283a94deadae0c4d9473e07edf8404c
SHA256

2c3a9222f6386a5910e372870adc01e93446891f066078f16461322339f38a32
SHA512

620366d726b70e4e793b847a66ee3bf3d98dfd0dbe13220f5bca7645582e681b263883f0f3b98aa10869bb978d78d410f336c4af4bb2ac5277e5f3ae452d0cc3
SSDEEP

12288:CSbrDABVRXXS1VHY3KJxni+n0VwmMcLWm9b10VHmDXTuFaa2AtyGTKOF25ZoJJyI:CSbu5wxwVL1WWb10hJaothZ2/T6FBBB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2556	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2556	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2884	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2884	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2884	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe
2556	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2556	2884	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe	28
PID 2884 wrote to memory of 2556	2884	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe	28
PID 2884 wrote to memory of 2556	2884	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe	28
PID 2884 wrote to memory of 2556	2884	fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fbd7a806b1d659ab97694a2dc84ca688_JaffaCakes118.exe

Filesize
771KB

MD5
4abd049642ae3aa20930d63114944e5f

SHA1
74ed04c7737d956a4fd61dd507ecca1f4125af8f

SHA256
449a7b9aee679be433e5b11c69625f1d7c3412a2e6551236ba8da6884fd55dbc

SHA512
b376560e37328133971c6d3ee1b3a282ea421874ea9455650287b6c7ed80d75a92987ad80fdd7594983fe62d4a27f9deffffc8f6c0a56024391674063b434801

Download Submit
memory/2556-17-0x0000000000360000-0x00000000003C6000-memory.dmp

Filesize
408KB

Download
memory/2556-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2556-25-0x0000000002D20000-0x0000000002D7F000-memory.dmp

Filesize
380KB

Download
memory/2556-49-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2556-50-0x000000000E860000-0x000000000E89C000-memory.dmp

Filesize
240KB

Download
memory/2556-44-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2884-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2884-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2884-3-0x0000000000270000-0x00000000002D6000-memory.dmp

Filesize
408KB

Download
memory/2884-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2884-12-0x00000000030E0000-0x0000000003146000-memory.dmp

Filesize
408KB

Download