10316232073950ffe2fd7776d64a5563ae5cc0f7f2d40cd301574dfa8a0ff1c7

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 09:11

Target

f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe
Size

48KB
MD5

f5713388c573a941365759c0eca4fa14
SHA1

9627dc4277d059d61ed70e22a60143e54aef02cf
SHA256

10316232073950ffe2fd7776d64a5563ae5cc0f7f2d40cd301574dfa8a0ff1c7
SHA512

e01eb1a044465063027d4c5076ebb3efff6a91cdae7510cc53db83384d2463afa2a5de583863d62b538bfa30db04f6274d3e3c826aa9536325fa4ef70f23025a
SSDEEP

1536:bovxqfQnP5QLWgcD0X/ZwJxj3Bibm9GijE3B:tcPa20xwjLBiiJ4R

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Update.DLL	f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Update.DLL	f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6450D9C6-4CC7-4826-8EFD-1D04AFC7F7F0}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\Update.DLL"	f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6450D9C6-4CC7-4826-8EFD-1D04AFC7F7F0}\InProcServer32\ThreadingModel = "Apartment"	f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6450D9C6-4CC7-4826-8EFD-1D04AFC7F7F0}	f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6450D9C6-4CC7-4826-8EFD-1D04AFC7F7F0}\	f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6450D9C6-4CC7-4826-8EFD-1D04AFC7F7F0}\InProcServer32	f5713388c573a941365759c0eca4fa14_JaffaCakes118.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4748

memory/3484-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download