Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-10-2024 11:19

General

  • Target

    57269a16125e2dafb7a818aa26d5d533_JaffaCakes118.exe

  • Size

    385KB

  • MD5

    57269a16125e2dafb7a818aa26d5d533

  • SHA1

    56dd470b9172cfed2fab615001da0c13a1a4acbd

  • SHA256

    575f198af455eec79da5c0ec6fdf50e6c6cc4078164cf2b1913327d73b528fc0

  • SHA512

    2c9a7c17a645b83b03e5c0ac3312a9e7e6cf0b17e6f3e8cc3bb86c0c4751f93a6e1816a0328aff966fc8d40481879b85312357d55ca0d124769787d4493771a9

  • SSDEEP

    6144:slyd+u6vP0FxJB7ikxl22v2ezJrB3kyEKtyitNyIaWQT+nMfC8qqYqipdQ4vPCv5:ri87HXjd9B3rE0YIabTM5pdvOB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57269a16125e2dafb7a818aa26d5d533_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\57269a16125e2dafb7a818aa26d5d533_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\57269a16125e2dafb7a818aa26d5d533_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\57269a16125e2dafb7a818aa26d5d533_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:4888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\57269a16125e2dafb7a818aa26d5d533_JaffaCakes118.exe

    Filesize

    385KB

    MD5

    c22e719f674bfff5b1e58f95b8d74592

    SHA1

    0bc493d5b35de5c5fb7d5d15398da7718e5a9d96

    SHA256

    fe37b4ec47f67c0fc5b5c17d35e0442a2a7fa404579d3f3176c8a1c29ecad139

    SHA512

    2909789f3fa796bc7712f259a5d53dcb7333d892549c61280120aeec7b00ad52dd2da38ab39f831bab5dcbce40271f811ce1a5ae96d20ebd8f924e9d40e3e1e4

  • memory/2312-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2312-1-0x00000000015B0000-0x0000000001616000-memory.dmp

    Filesize

    408KB

  • memory/2312-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2312-11-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4888-13-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/4888-14-0x00000000015F0000-0x0000000001656000-memory.dmp

    Filesize

    408KB

  • memory/4888-20-0x0000000004EE0000-0x0000000004F3F000-memory.dmp

    Filesize

    380KB

  • memory/4888-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/4888-35-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4888-41-0x000000000B7E0000-0x000000000B81C000-memory.dmp

    Filesize

    240KB

  • memory/4888-40-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB