Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
27-06-2024 17:07
General
-
Target
16ce218ffe33f5e92083627685528426_JaffaCakes118.exe
-
Size
56KB
-
MD5
16ce218ffe33f5e92083627685528426
-
SHA1
704844d1e5d0f3585d74f43e2d3d1c9362272cf5
-
SHA256
46ace6d67188577c7fccf74fc799294f1d23389ddb22f883a96938e9b9d657f2
-
SHA512
d31e0631547a2504b4696a37f8b3ff38f011ca1792d7284272176ba20f49f210fd92af40db77b6c04233f0ce21ee00c5ee5b9b71cf8bbb430b5462df22e9752d
-
SSDEEP
1536:QrLbZnmND6dlgbSOb8MQ7eVeOQ5Rg2+EBf8Hj2:QrPRmF6fgbTQ7CRW+2+Eh8Hj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16ce218ffe33f5e92083627685528426_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16ce218ffe33f5e92083627685528426_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\16ce218ffe33f5e92083627685528426_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\16ce218ffe33f5e92083627685528426_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD54521501338d500637f8c8712fb2f146a
SHA1e9cd4d04b5d6f985639c1e6199e44369b6a66ab9
SHA256c3970abb12d85a9333b3813a5794c397924d9f25dc3ac1f00c947782c59a93d1
SHA512fd6a1794c1d5f476d4e9e3923c1b8a0c784069d4508b28eaad15ad47794bfe5b6c80454ebc5b7ce5b743282cb603aa69e0ab81441a77a6b4fea1f382458daae2
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB