Analysis
-
max time kernel
32s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
12/07/2024, 23:57
General
-
Target
3f62708cfaf71cfe8b39c28efd578586_JaffaCakes118.exe
-
Size
133KB
-
MD5
3f62708cfaf71cfe8b39c28efd578586
-
SHA1
fc59ff968077ed772a925a255802164f9d151641
-
SHA256
10d73aa09a5f8a55334851cbf5ae8ca08658c3065d2e6c53ee099a3d456e2638
-
SHA512
249c168feeb3a5ef6cf06ef57c3304303424d1d04ad25e1fa8bff22b287c61fd1919b305936a4bf8efa1f98acb0b7914a4bcb6c694db18bd337e170da500cc0e
-
SSDEEP
3072:2IFwS3fASunOzQ+dtUx+abAY4jHMuhShvPs2wUmspOgY7wsyDezQ:2NwfA6zQIt80fDbAhOUmWRY3yAQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f62708cfaf71cfe8b39c28efd578586_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f62708cfaf71cfe8b39c28efd578586_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f62708cfaf71cfe8b39c28efd578586_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3f62708cfaf71cfe8b39c28efd578586_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD54079d1d4f8d6cb7f4a79d60b8f771d54
SHA115c50dc0b9cdfa1a8c3834eb6d0d1b25eed7c1e3
SHA256f3d23b5e92895f26ec51c210ff767096304be929db3f6e38345e65c64b3de47e
SHA5128d129c321cdea90022e554ec7d84c12bb12b8a7608e7022238f64eb71321dc677e9f9b4f886ef6650e3c466d53e5821fa46adab09ff611f09f94e220b16b2311
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
536KB