Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 14:06
General
-
Target
fcedcf99a7d7cc220a81e52ab479abdf_JaffaCakes118.exe
-
Size
82KB
-
MD5
fcedcf99a7d7cc220a81e52ab479abdf
-
SHA1
1654025e6aa19bc267127e26003f7b316917dd3f
-
SHA256
ac664d3604aa9e4805e85c467b053ddecbe5700feca7e138db7ce3b1bf8db62c
-
SHA512
c8b5e80a145e9cd9b1e4405f863489bd7964bb362981f2e343c93df07be33953f5f6bd5d985c23cd9d3713366f7f7416a66132aae872e5c94660cc380536d15c
-
SSDEEP
1536:8QxPHEmFjYCmM8C9ICidyuDdtQMylfkKkiSwWagkJ6i9nKCxyqCIJsSCR3gA9h/q:8QxPHELeICidyurQNxkKKavYkNA9w0wh
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcedcf99a7d7cc220a81e52ab479abdf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcedcf99a7d7cc220a81e52ab479abdf_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fcedcf99a7d7cc220a81e52ab479abdf_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fcedcf99a7d7cc220a81e52ab479abdf_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD52228528613c60b5fef9a11b1f335a898
SHA16aa801d024be60f56a3e1a2b39b5637317dbdb52
SHA25663522874ff3f05c8c384c7a36c08e952f943a559b70ff3e187cbf60d7697a96d
SHA512e8f6aaf00c207846ad8662e31bb891c2efda2d17544a35942bbe4cc4dee450b775e789e57a4d8ae4c1e7e3f023d446bf2c93cb812fa427504fb99b1c579c0de7
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
56KB