Analysis
-
max time kernel
93s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
09/07/2024, 02:26
General
-
Target
2eae0f59a0c8436672b01fac33ab0cf7_JaffaCakes118.exe
-
Size
266KB
-
MD5
2eae0f59a0c8436672b01fac33ab0cf7
-
SHA1
56a9dcd5a1ee241697413a49760789ecea97e061
-
SHA256
0ea3c0aa204a8f0a12ae72610161b2b4cc24dfc0529bf357349efd2f4446995a
-
SHA512
1aecda66db8802e9bdb780c67cf8e0e1a4b55afa94140fab28ad7d8db2f2b8c4f3937108862acd9ca119c163d235e2e4d37a052b9d5a5fc747a77f2315180aec
-
SSDEEP
6144:DPT6+5GX5x0vHCw8r4ksloo4YHkAY3ZFSd7TaRGg6f70dQ:Dm+5GJxiCxnCYpFSERP6F
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eae0f59a0c8436672b01fac33ab0cf7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2eae0f59a0c8436672b01fac33ab0cf7_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2eae0f59a0c8436672b01fac33ab0cf7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\2eae0f59a0c8436672b01fac33ab0cf7_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266KB
MD547f41986ad0ac2a8d6fd33131abc8be7
SHA1cf071955f29991d0571432b9890354970c5136d9
SHA256cc1e0e323e39677dacf33f1d452be1efc71717ff08edbcee00965317ea8e9583
SHA512ba9bdcf23807965a0e7e928f0071675ab8cb73def8cf0d31bc9304895bb459e06248941a38c8ba26868d9acf115ba0a945e6697b496203c3a5dc05d1cedfa649
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB