Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25-06-2024 22:48
General
-
Target
0fcff1f10b42267459e4c0a8b3c52281_JaffaCakes118.exe
-
Size
133KB
-
MD5
0fcff1f10b42267459e4c0a8b3c52281
-
SHA1
1025602e3bbc2847e821dfecc14aee9f10001479
-
SHA256
04f859e458365c89d36d09144b9875358e69ddf0981bf7eb557051a180a0ce19
-
SHA512
77561966b1d7493750145edebc2ff1c08e4b32c19f4bf90fcd3f70965e497932aa8bcb92e91fc5777009ffe28f98c78b23c565ed5bf7df0580c7a3f7304eb0a5
-
SSDEEP
3072:gFSH46dJvVL2ZawUuMvrsXtKD5MYsHKQHEzjkpXbahplQ:NtJvVCEtuMvIXtC1QHE0pO3lQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fcff1f10b42267459e4c0a8b3c52281_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0fcff1f10b42267459e4c0a8b3c52281_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0fcff1f10b42267459e4c0a8b3c52281_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0fcff1f10b42267459e4c0a8b3c52281_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD59afc36430809824a61511f93bfd30f5b
SHA116fbcecbbaf65c07539bdcd0a10c5760cf6f4b32
SHA256d21ffcc20ee0c1b64e6641f2c0ca644521062fda6c42cd25e22f16ba18d81662
SHA5120404073c9e8e82230aaa227292690ec63245fb39c0323024c7e5dfba22bfb044855b1c4e4003d8cf143cde9795ea6abefdcc8b1294125302907c0cb5597a8ccd
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB