Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15/07/2024, 06:27
General
-
Target
489a1991799eb0b2672ce6d5eb71bcf4_JaffaCakes118.exe
-
Size
133KB
-
MD5
489a1991799eb0b2672ce6d5eb71bcf4
-
SHA1
04813f8e29fe975f746839365ccd9e251ef6ca1a
-
SHA256
ede9da5154185c24c18bf3ec8ee5d69d6a1412824b7fa7d9b968f02c5ef9ddcf
-
SHA512
063dd79426e07867c1d29c0b85bd3642ef623f4f2d49c5ee0b0a1e0cd24603c9d26d407180f032d96570d4bffb9688e14d50da0fb0028c05df52b1f1466d89d3
-
SSDEEP
3072:CEyTUX4V1CRosbgT0VUXUiaDHBCirm1dXi7tzj3ZssHQ:e3QysUGUY5mXSFF5Q
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\489a1991799eb0b2672ce6d5eb71bcf4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\489a1991799eb0b2672ce6d5eb71bcf4_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\489a1991799eb0b2672ce6d5eb71bcf4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\489a1991799eb0b2672ce6d5eb71bcf4_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5a97e3f442c989f90cd616bc7877c3050
SHA174141ce02d4ed4c10a564e2764e91a6e30210751
SHA25652195a45f95cea24b24bd35cba1c8404ce354a55007684e7c2049bb3ef094869
SHA512860323c9c28cc483427db06ce8ab598925399f14cca52c231646d0267cb253d432df98fab78d939e232464003eedf38ecebcde86ca400ed1729bde82f1e1d976
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB