Analysis
-
max time kernel
42s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04/07/2024, 17:05
General
-
Target
259cfcac8af76f072c9436ae71180dc1_JaffaCakes118.exe
-
Size
133KB
-
MD5
259cfcac8af76f072c9436ae71180dc1
-
SHA1
5595f51e1dad1a2637e4b29c274a5e8fd1c1a336
-
SHA256
2fd8f690fbcf45894623d48690a6b2d57a7a1d369fa72077235d807f14be3e52
-
SHA512
f3ebfe73952e6070a0972e8ca61b7e96170982f5607b8f81b6e4c59e73d82fc567264df0688419b4658807d4c7aed8395c795cacdd444d040412ddf3da445120
-
SSDEEP
3072:qFxA8Q/cxjDXa6JRSxMi1M5Eb7hKuL9vpkVX+yBlS/Q:qFScPXa6SakJpk0wlS/Q
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\259cfcac8af76f072c9436ae71180dc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\259cfcac8af76f072c9436ae71180dc1_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\259cfcac8af76f072c9436ae71180dc1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\259cfcac8af76f072c9436ae71180dc1_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD592fe093d3afcfcf4fcbee958e01efc27
SHA15ad42b26a1599f34316f1d85c70c4d644e13b2a4
SHA256ace4fca2a517324487adcdd7ea0ef0c14c3f85a9d8f1a5ff13cb4cd6f42b2dfd
SHA512e5f627812eb95776b35a0f53149dd8944279a99dab2828146d896fb4a7520deb3fbef3cdafaf86dd8e950a882038d8f9033dee05ed04656d97fa768f82621a3f
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
132KB
-
Filesize
124KB