Analysis
-
max time kernel
100s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
21/07/2024, 20:14
General
-
Target
613d841e5405a2ca080cc7128016a3b8_JaffaCakes118.exe
-
Size
266KB
-
MD5
613d841e5405a2ca080cc7128016a3b8
-
SHA1
e9a05caf41f6cfdab85124e9f546de02d541dfb4
-
SHA256
e48fe2d72091b8f1b71ee94404372629af130002308c08d194965488159b8197
-
SHA512
04bb38606dc3e0edb37323a8527523f25dbf5e005a4b84a1c415a3920421f1cfb952a0b20378d2bdaced3613b86ca9ac8cdba2c15cb93ead7816df2ba867ecff
-
SSDEEP
6144:94o8Goc+E6oMT/bTcio5FgXvrm+EG3AYHePTju5QR0fPO2g9+JvIM1CQ:uxGoAMTbwX0rmOMx6POR90
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\613d841e5405a2ca080cc7128016a3b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\613d841e5405a2ca080cc7128016a3b8_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\613d841e5405a2ca080cc7128016a3b8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\613d841e5405a2ca080cc7128016a3b8_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266KB
MD547e88675f1922f5daea67ebe543ac51d
SHA1b6664ce1d63dbb1f2c481de91d8bc04f5d5205aa
SHA25696afb4370521de288272de467c93be190e422ea42b1f9edc9e236d0eb76ea8fc
SHA512a0018afd7d4cb1c6dc7e6ee7039c07bf5e2358be4cf5f7db5ac296c28bd58e6e155c6b9c78b072fe1ea2a4503fb9c71f9b3c6b18b319fc0353e6eee7faf4f52b
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
536KB