0714024bb77dcbc120576660d90de73cce3dd3dbb96cb6b6b153eb24189dbfb9

Analysis

max time kernel
135s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 05:59

Target

f7677b28b277f9338a866676e74a16f3_JaffaCakes118.exe
Size

9KB
MD5

f7677b28b277f9338a866676e74a16f3
SHA1

f86c4a6c014b4e2ce2f5db27460f680995308079
SHA256

0714024bb77dcbc120576660d90de73cce3dd3dbb96cb6b6b153eb24189dbfb9
SHA512

7cf01568986966438d73268c0746cfad0f56d1c532998462bd99699844f0836e0bafa39c50cae65a740c1379256b837ede658461f6cb954ec3bb69111cfa61f9
SSDEEP

192:qJOmOKeKlXron50sjoaiSRTTlYSCJBu7lR:qJOmeKl7e50sjzvRflXCDu7l

Score

8^/10

persistence

Modifies Installed Components in the registry 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{77117a37-ff99-44ee-44ee-00aa03c0e46a}	f7677b28b277f9338a866676e74a16f3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{77117a37-ff99-44ee-44ee-00aa03c0e46a}\StubPath = "C:\\Windows\\system32\\igy\\lsass.exe /t"	f7677b28b277f9338a866676e74a16f3_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	f7677b28b277f9338a866676e74a16f3_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\igy\lsass.exe	f7677b28b277f9338a866676e74a16f3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\igy\lsass.exe	f7677b28b277f9338a866676e74a16f3_JaffaCakes118.exe