Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 03:03
Behavioral task
behavioral1
Sample
fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe
-
Size
784KB
-
MD5
fbc9755f90c014de6792506d1e7ded3d
-
SHA1
738c1c0028a13b2b3af75dce231e0bf2317459c1
-
SHA256
cf11bff110fd0c97987fd66ad1ccf3d4da79af1bc2b532df8ef64b7eaff8d174
-
SHA512
9de10094c27308e052c8706f1431e430acb9b177e5bc407698866ea4b006cfeb95a78d3785eaf21830e98e415e37f9281c653ac3c9d3b5905f6172d80c329cfc
-
SSDEEP
12288:zenLtsWghSCb6Go7VbkU92TofIUwkpOYr5amm8sdHUrmutq3I/9EXlSC20NZvI:zFhnVoVbk4DIUjpbt61d0rbECWo
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1604-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3564-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3564-20-0x0000000005490000-0x0000000005623000-memory.dmp xmrig behavioral2/memory/3564-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/3564-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
Processes:
fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exepid process 3564 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exepid process 3564 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/1604-0-0x0000000000400000-0x0000000000712000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe upx behavioral2/memory/3564-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exepid process 1604 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exefbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exepid process 1604 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe 3564 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exedescription pid process target process PID 1604 wrote to memory of 3564 1604 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe PID 1604 wrote to memory of 3564 1604 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe PID 1604 wrote to memory of 3564 1604 fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fbc9755f90c014de6792506d1e7ded3d_JaffaCakes118.exeFilesize
784KB
MD5b95ebbfc6992f7f30128b47b9128685f
SHA16ea35436688058833b080bd6583c46157fcbf0bc
SHA256362beb1bd9aefc75a2ab1336b2365f7d03a3009800d431c068c10eba3d2583a9
SHA5128a24a29de9f9e5b25016dfa7c7ca7e0290232b6f6678f3fc45f0879ffe4b889846d86a5b73910749d2da8853e6d735f1ba0ea4e5aa141bbb6d2f141c7330652e
-
memory/1604-0-0x0000000000400000-0x0000000000712000-memory.dmpFilesize
3.1MB
-
memory/1604-1-0x0000000001AE0000-0x0000000001BA4000-memory.dmpFilesize
784KB
-
memory/1604-2-0x0000000000400000-0x0000000000593000-memory.dmpFilesize
1.6MB
-
memory/1604-12-0x0000000000400000-0x0000000000593000-memory.dmpFilesize
1.6MB
-
memory/3564-13-0x0000000000400000-0x0000000000712000-memory.dmpFilesize
3.1MB
-
memory/3564-15-0x0000000001720000-0x00000000017E4000-memory.dmpFilesize
784KB
-
memory/3564-14-0x0000000000400000-0x0000000000593000-memory.dmpFilesize
1.6MB
-
memory/3564-20-0x0000000005490000-0x0000000005623000-memory.dmpFilesize
1.6MB
-
memory/3564-21-0x0000000000400000-0x0000000000587000-memory.dmpFilesize
1.5MB
-
memory/3564-30-0x0000000000400000-0x0000000000587000-memory.dmpFilesize
1.5MB