Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
28-06-2024 04:59
General
-
Target
18dc6bdcb5c36de68839304c2a81e000_JaffaCakes118.exe
-
Size
918KB
-
MD5
18dc6bdcb5c36de68839304c2a81e000
-
SHA1
bd4404955256239e5cb1b37672b0d9511ae12333
-
SHA256
9df8be0b257075a8b0d55b10fe71ca59e92fe6ead650e2deb2e7e805016cd043
-
SHA512
74fbe1532e6b63edad6a803c46909dc1cdbf529dc22656528134100e03592338d21ca508db3e4957b75854730febc221fc0cd29def77b8c808208914d17385a8
-
SSDEEP
12288:1nLed8niQBIzo5zOmTU6oGo7dBOTOLJc20n346f4Na+opkmTU6oGo7dBOTOLJcM:AGiQezovTFoGohUR0lYTFoGohUi
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18dc6bdcb5c36de68839304c2a81e000_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18dc6bdcb5c36de68839304c2a81e000_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\18dc6bdcb5c36de68839304c2a81e000_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\18dc6bdcb5c36de68839304c2a81e000_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
918KB
MD53286443c6623a5ee4352795a5cf26dc7
SHA1b05fa1019ff4419aa7680fc70be903ccb0350ad2
SHA2566900e7993462b61192aa733d80af175cda3b4d332c5b69dc0fa0af40e1a4dd07
SHA51210c907e75bbe7b3a4ea5f7cdb0eff6689e338efd1d26702ec495b46a568506ca948dacfb0e7453bb723ed9e853384cc72cdf97371c526abb91aba23867426ee6
-
Filesize
896KB
-
Filesize
196KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
196KB
-
Filesize
896KB
-
Filesize
896KB