Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 11:45
General
-
Target
fcb23b1b99d7bd05bd1f57a95075decb_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
fcb23b1b99d7bd05bd1f57a95075decb
-
SHA1
51943216872e097f0d54c13a6cf14bea0cc63426
-
SHA256
a397ec9cadd4ea511c0b37fe31a67dae8e0277ed8baf583ae1914f04883a9194
-
SHA512
13e89c86dfe322c2733c5ae6547433677fdaae398863efb65c33f802c2718f5885330fb2490da4df9580f39c20097f257195aad03b9444d362c82bd1335c3409
-
SSDEEP
24576:pCMgvj0EWqWCZLL+J3/teF67vwOS3Y+Ne3lvVpVqFd1RqEGvG:psvYEaCZLL+h/te47YO8FNwv3cFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcb23b1b99d7bd05bd1f57a95075decb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcb23b1b99d7bd05bd1f57a95075decb_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fcb23b1b99d7bd05bd1f57a95075decb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fcb23b1b99d7bd05bd1f57a95075decb_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5a09649d87a5ef0c0c1e6a67d8cc99348
SHA1018137262822da8cf4aa952bbf64e9040d4c75ff
SHA256ef4f5a8165f20aa9b048976b8b6419e2604da75f9190a4d9e4eb9a092eee95f4
SHA5123dee939c96ea98dd007d5f09b8ffecf7d60af3fdfb59cb6d4835459886914840bab8e897ef76adab8e4ff6add2c72e735d0dbca0a5fbb0ea2c9ee2373a4e5ca6
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB