56092afde17b0a37371eaa55f0066312fa7b6a5987f958d65b5687ebd3668c04

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
Size

385KB
MD5

fce146004a31da9bfdc95fbd7300eeca
SHA1

059c2a31eed4b30daee512845bf5aebb3f7c1e76
SHA256

56092afde17b0a37371eaa55f0066312fa7b6a5987f958d65b5687ebd3668c04
SHA512

b26e7db9220bebfc1f9c70815fb77f4316736cea913feb3a9a6b68aa2cfb401895520f064a2a8d3dcce61babc6cc7a8ecd85f52440074da8349f4139918358bf
SSDEEP

6144:DKeeI5LrPd8zff+252gklZxISbtiS2/FrV5v91Ug0Mmu6bv4jKvizYqTXdPT8B:DsI5LruC252DnIldrOicqOB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3728	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	pastebin.com
7	pastebin.com

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3948	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3948	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
3728	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3728	3948	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe	86
PID 3948 wrote to memory of 3728	3948	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe	86
PID 3948 wrote to memory of 3728	3948	fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fce146004a31da9bfdc95fbd7300eeca_JaffaCakes118.exe

Filesize
385KB

MD5
ed51c08711a506c89241121b7d4d8a2f

SHA1
bd3ca697c383ccb4419ebd1f05650d0f65d4fb0f

SHA256
e906bc4d9c005c50fb34142ebfb33e7aa7bdf17423743786c89ad28187650d59

SHA512
b9dce64a9c8ae5d513e0e7ea47dfd8aded1780cf9947a3413afbf8590fa51936a76bf622ae97fcbd002e036f635709463f8cf4ccdbc786ed9d070a452a9364da

Download Submit
memory/3728-35-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3728-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3728-15-0x0000000001470000-0x00000000014D6000-memory.dmp

Filesize
408KB

Download
memory/3728-20-0x0000000001640000-0x000000000169F000-memory.dmp

Filesize
380KB

Download
memory/3728-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3728-40-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3728-41-0x000000000B7E0000-0x000000000B81C000-memory.dmp

Filesize
240KB

Download
memory/3728-42-0x000000000B7E0000-0x000000000B81C000-memory.dmp

Filesize
240KB

Download
memory/3948-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3948-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3948-1-0x0000000001610000-0x0000000001676000-memory.dmp

Filesize
408KB

Download
memory/3948-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download