2430984b3775a05a0230fdc7cb2ae0fc93875d889de85101f189f5d2c6ee0367

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9d02bc804bc484c7d896f389d43362e_JaffaCakes118.exe
Size

227KB
MD5

e9d02bc804bc484c7d896f389d43362e
SHA1

b186370ea82113a8c0d50146d92886cab9fc849f
SHA256

2430984b3775a05a0230fdc7cb2ae0fc93875d889de85101f189f5d2c6ee0367
SHA512

9cbf4b3e1c01fdd75076194bf1539da68bfc87fc1d0c86508d0468709798cffbfca176e2e19165ec0e66feb6cf9be449065217c03f3285fb3c20559daf3fdcd9
SSDEEP

6144:gGihtxcBnFe9XgAeLt23rjnax9JVkb2y8:XidcceZ23rw9JVkb2y8

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ClickIt.job	e9d02bc804bc484c7d896f389d43362e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e9d02bc804bc484c7d896f389d43362e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9d02bc804bc484c7d896f389d43362e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1612-3-0x0000000000120000-0x0000000000140000-memory.dmp

Filesize
128KB

Download
memory/1612-2-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1612-4-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1612-5-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1612-6-0x0000000000160000-0x000000000018F000-memory.dmp

Filesize
188KB

Download
memory/1612-10-0x0000000000120000-0x0000000000140000-memory.dmp

Filesize
128KB

Download
memory/1612-18-0x0000000000120000-0x0000000000140000-memory.dmp

Filesize
128KB

Download