56092afde17b0a37371eaa55f0066312fa7b6a5987f958d65b5687ebd3668c04

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
Size

385KB
MD5

fce146004a31da9bfdc95fbd7300eeca
SHA1

059c2a31eed4b30daee512845bf5aebb3f7c1e76
SHA256

56092afde17b0a37371eaa55f0066312fa7b6a5987f958d65b5687ebd3668c04
SHA512

b26e7db9220bebfc1f9c70815fb77f4316736cea913feb3a9a6b68aa2cfb401895520f064a2a8d3dcce61babc6cc7a8ecd85f52440074da8349f4139918358bf
SSDEEP

6144:DKeeI5LrPd8zff+252gklZxISbtiS2/FrV5v91Ug0Mmu6bv4jKvizYqTXdPT8B:DsI5LruC252DnIldrOicqOB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2244	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2244	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2244	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
2744	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2744	2244	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe	28
PID 2244 wrote to memory of 2744	2244	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe	28
PID 2244 wrote to memory of 2744	2244	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe	28
PID 2244 wrote to memory of 2744	2244	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Filesize
385KB

MD5
7aa86aee8c54c8dd755cd1c7c25e1a3b

SHA1
fafea43d09e4da1107a9da231fe1629be62aa2e4

SHA256
d7d6afe901f37c2d73df5ec70d67457314207ba79b2f49707e6229ee1769ad8d

SHA512
46e4f782268e5a73e916cdc02786075458e724557cc601623bc2e4d8e9dd5eac7a2cd5bfff36dbd15487d1b144e87acc82841043a39a6d707443c83af604b554

Download Submit
memory/2244-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2244-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2244-2-0x0000000000190000-0x00000000001F6000-memory.dmp

Filesize
408KB

Download
memory/2244-14-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2244-12-0x0000000000290000-0x00000000002F6000-memory.dmp

Filesize
408KB

Download
memory/2744-16-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2744-17-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/2744-24-0x0000000001670000-0x00000000016CF000-memory.dmp

Filesize
380KB

Download
memory/2744-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2744-45-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2744-48-0x000000000EAF0000-0x000000000EB2C000-memory.dmp

Filesize
240KB

Download
memory/2744-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download