Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/04/2024, 17:23
General
-
Target
ffc8e353a6c98966981fbbbc75c49de9_JaffaCakes118.exe
-
Size
116KB
-
MD5
ffc8e353a6c98966981fbbbc75c49de9
-
SHA1
a47b297113df9b528b75290dd4a55f7c50bad58f
-
SHA256
bfcd85c519773aae02dccd91cba0f64730df2ccbe4088fdf1bd4ebd6e8076af2
-
SHA512
47df5fd81d9045d01f2bb9c47f070d5f25aa57d3368a309dd6d518d4232bf25d151cc862ded5169dd5ee6bb260ca5ce89fc092ceceb413b556e44aa54c67af20
-
SSDEEP
1536:NeM5JJqUQ8cYE4+VXI9Cwkx5V4pDJ26GZVeJsFcBeIymwPZAgwuxDnghsRcQP6bT:NeMXTQdg09IJ2lZVeSkyfhHDn+lJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffc8e353a6c98966981fbbbc75c49de9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ffc8e353a6c98966981fbbbc75c49de9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ffc8e353a6c98966981fbbbc75c49de9_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ffc8e353a6c98966981fbbbc75c49de9_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD50fb3393d451e97b9464d7d2800694cf2
SHA13f038be127bf29cff9348a93f8ebe80e3bf90803
SHA2563fd37bf7dbb6d8960bade708c2745c2acced8d521060eefc405229409b8f573b
SHA51249f95bccce2064e9ec762a78bfaf8d00819efd5921775e4ca0c8eca50613027c0b5e7402e15cb857b8cbb35c6a2afcbd18efef18281840ad14fb80e31b2db4ac
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB