Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
12/07/2024, 08:01
General
-
Target
3c9580c65766ab88c7c031c04bb4dbcf_JaffaCakes118.exe
-
Size
56KB
-
MD5
3c9580c65766ab88c7c031c04bb4dbcf
-
SHA1
df977afc5b63b75a0713bf0772b81ad9f9e673a7
-
SHA256
2bbb413214ac10551b86aa68dfa84175a0f5323b2b903cc1ded168e4db008cc2
-
SHA512
0e33fa08f04420f9983c51e18f56500ee6670c8183bea708d300a5bfd00564ba2a572fb92316c867509457aaf050bd462ed1f3761affd1480243baeaf3b03608
-
SSDEEP
1536:oW6XbxH8NmPeS5fDrrrUd7dWzNaAQEflkAvtgGA:oW6bxHUmPPDEdWZaVEC2gG
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c9580c65766ab88c7c031c04bb4dbcf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c9580c65766ab88c7c031c04bb4dbcf_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c9580c65766ab88c7c031c04bb4dbcf_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3c9580c65766ab88c7c031c04bb4dbcf_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5e1a08a37379b0a96f696d7eff8294bd5
SHA1437dab793dc6c5ac6645d82e85a723fe17395bdb
SHA2565e538c200d919a799ff16b1bb0d7922f3105722a0a4a796bd55d69b39b50bda4
SHA512e7cedd49d0abfcca3a1bc19d0ff237fb4b0bf77d27b122881cee442c6a0000c83cfcf921d569d053eb149cf21c38052508e792b654e3e354013a179848f101ac
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB