1b347e6fadfde1279a896e35ebbbbff417a6fe2b787a8d12191e9d3423dc30ff

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe
Size

320KB
MD5

07a6069935b4239de79069481e43d9a9
SHA1

158b639df41739136e9133ecd00e1fb3dc812489
SHA256

1b347e6fadfde1279a896e35ebbbbff417a6fe2b787a8d12191e9d3423dc30ff
SHA512

8f8c3e45ebea30c0cdd043ce18df777388e82b2a924a9d15779f383d5ccffb42e80294c7af62e374f1e8a66c5338c8ec03458c54afdb916310edfde18f2c7f6b
SSDEEP

6144:FMBMXBfEpLjJelc/dV3CImWhJMtC7LvaSXG+duyNrPjEOMlqKVeWzY1:FW+BwZIe/3CImmqtwjaLQuEEOhKVeB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
384	07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe
384	07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
384	07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe
384	07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07a6069935b4239de79069481e43d9a9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dfs1536.tmp

Filesize
608KB

MD5
5be8e7b258edda04e391c84db14b9ff9

SHA1
756cfef5c16ff7151ac1c23a33b723c1d1ae5e95

SHA256
9a4ca20198209ab3a4bcae2cf1882242ac1e47ca4c25d08e961f23f50ff8b343

SHA512
ab1036f51403ed9c2f6aa9f39f095c9362d2e85c33f6b006d374e2f17ff55aab9d8400d0ef8b14b843f64a31aeee7267e8130cebc183de8dbdd3265f5bab4021

Download Submit
memory/384-1-0x0000000000B70000-0x0000000000C3D000-memory.dmp

Filesize
820KB

Download
memory/384-5-0x0000000000960000-0x00000000009FE000-memory.dmp

Filesize
632KB

Download
memory/384-6-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/384-7-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/384-8-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/384-9-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/384-10-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/384-13-0x000000000A9C0000-0x000000000B166000-memory.dmp

Filesize
7.6MB

Download
memory/384-21-0x0000000000B70000-0x0000000000C3D000-memory.dmp

Filesize
820KB

Download
memory/384-22-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/384-23-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download