Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21/04/2024, 16:11
General
-
Target
ffabf4729a35631969269c6a7f4568cb_JaffaCakes118.exe
-
Size
241KB
-
MD5
ffabf4729a35631969269c6a7f4568cb
-
SHA1
5cbe02068968110acf064f7ea6a76a9404985263
-
SHA256
bb09c951e1594b3a2da7ca435ba693d419e84029f8d32e3dabc73aebb5b35e34
-
SHA512
7c025e582a49395b4c78126919f7a86866aee10b309b3d15b8d8de50e1860140268a885165a0aca7beeeb312dcaa16a6abc137fd8bfc5d87fb585ea476256547
-
SSDEEP
6144:F9tGyuXd9TpU71a1jKutzauuobIta+EHOMRPleN7+11uU:FjFuX7i71AKutzauBwamMPuU
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffabf4729a35631969269c6a7f4568cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ffabf4729a35631969269c6a7f4568cb_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ffabf4729a35631969269c6a7f4568cb_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ffabf4729a35631969269c6a7f4568cb_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\ffabf4729a35631969269c6a7f4568cb_JaffaCakes118.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
241KB
MD55c7e1c021f8c6daffafc2b7a6bad14ac
SHA1a7f1bf5a7a3dc6b06494342df3354159005fdbf5
SHA256f205ef766259c845edc69dd8bb0171c137a8d09b2f5ad2adafd1948682d609d7
SHA5129a1b39b18d4bde92378954e35cc740568acb9bd1b97579292f24214bf044a843fa58244e9442040e45aaf9121cd96c1ba70b86da0109b69eef55064657028a7f
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
408KB
-
Filesize
364KB