Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-04-2024 08:59

General

  • Target

    feeb3083f683f588ba427d42c4bcb587_JaffaCakes118.exe

  • Size

    133KB

  • MD5

    feeb3083f683f588ba427d42c4bcb587

  • SHA1

    23a345d92162459417632bbf19d5ad9ce7e81dac

  • SHA256

    28da39826a36c4d3e08b3c2cb84a37084a93d61979e3ba830950e1fb272bae7a

  • SHA512

    943d3a08b56f02caf935378e93bb21cdda0570021444cd9c39d3451ebe9759f7bd8bd4e78d6e1605af57589f3074b2630bee5588d07dc6b71fdcd3833d7d4bcf

  • SSDEEP

    3072:hiTTe5UApQ5Mxq/vmKme1DmHF9KFvXPVnu98p3sR/W8e0QQ270VQ:Ue5UAvSvmKF1qbKFPPVuSpcRRt27GQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\feeb3083f683f588ba427d42c4bcb587_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\feeb3083f683f588ba427d42c4bcb587_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\feeb3083f683f588ba427d42c4bcb587_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\feeb3083f683f588ba427d42c4bcb587_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\feeb3083f683f588ba427d42c4bcb587_JaffaCakes118.exe

    Filesize

    133KB

    MD5

    d735dc2d29a016012b59450507de2a1d

    SHA1

    72d163ea04291513e89747abbae1fbedd4045b1a

    SHA256

    f0066db7b9bd2ee5432a76cf4520d7cd5369ab49ab4f588c223a664eb4bad1ea

    SHA512

    03706747eb474357ba04b6b3add194b2140b532bfa747cabc09a8c5faa296f52cf94597b04184155f8045c70cc2cabaeb711c7ff964f38c178e41f6a93285ae9

  • memory/2024-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2024-19-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2024-43-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2372-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2372-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2372-1-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2372-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2372-12-0x00000000001E0000-0x0000000000266000-memory.dmp

    Filesize

    536KB

  • memory/2372-42-0x00000000001E0000-0x0000000000266000-memory.dmp

    Filesize

    536KB