Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/06/2024, 11:18
General
-
Target
0ddf3e1d6498ecd7fe7abba1959c9483_JaffaCakes118.exe
-
Size
56KB
-
MD5
0ddf3e1d6498ecd7fe7abba1959c9483
-
SHA1
d8bb40df08db690018c5b4dc4e8b5b48c8bc27df
-
SHA256
ef898023720fddb98a4f4f7ed3673cb21ff306e8caad2961d132c463a2db4682
-
SHA512
c7b153f4c729c2a3ff01a477dc6bb98e7ae11e22e3644a90df62d6ff8eb935b9c3a88401cfe8f8a32049c285f8bb60ea56ff11fd4c134b84ae009b6ca22d3d53
-
SSDEEP
1536:V0+hn7Qr0HyAszXOn16iRCnMPIi1RAd1Q0A11:V0gn7QrORl41A
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ddf3e1d6498ecd7fe7abba1959c9483_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ddf3e1d6498ecd7fe7abba1959c9483_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0ddf3e1d6498ecd7fe7abba1959c9483_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0ddf3e1d6498ecd7fe7abba1959c9483_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5c32356b34c2c8a888fcf2e5953b3c534
SHA14c8221ec6ec1f0563554aab1f6cea64fd3eee578
SHA256374c49cade739d9c8cce15e144e6b2c1995ddcedaf5bb53819ef5a80fc3a92c6
SHA512cfe11934bf1d5f88d5d8ddc95f60474102ed1dcd8ffed670080cd1a2738e06f3039965f8b18ad99bf697ddbfb50731cf2b83b492e1c1becdabaeaa381ac83d4a
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
232KB