8883cc13e0f391979e828931e59168cd8bdb1814598323622a51f85ab302f3f8

max time kernel
124s
max time network
127s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe
Size

131KB
MD5

08456d53df6abf9812cf4549b3b582ea
SHA1

500c86eb1e89469dd226f3d664e860f7676a9225
SHA256

8883cc13e0f391979e828931e59168cd8bdb1814598323622a51f85ab302f3f8
SHA512

40125b077f5485be87e6cfb1339651baae342046dc34ed9a5b97541486006511c959ebe89651a0264dd761167886843c6cc597b359cb8384675696999ff3c52b
SSDEEP

1536:BL+O/U7OBmKGS6CBK0t/ZCXPGuxgDM5YKBGNc/xf6KWcs8+SUkIcekqY1o/uImzk:BLxUyjp3xCTyDMsUWyw+Ubx7NR

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\ehw3apxflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe"	08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

C:\Users\Admin\AppData\Local\Temp\08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08456d53df6abf9812cf4549b3b582ea_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads