12390bead3a2ab35c29339f10a0f84f93dcaf78ec4b2a2aa885f6c0eacd76e85

Analysis

max time kernel
129s
max time network
139s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe
Size

312KB
MD5

0a7f199cf7a911c107d4d4f612ba3ad1
SHA1

dde5668b97b60b16d36f5ebc97ef2058ae8cdf51
SHA256

12390bead3a2ab35c29339f10a0f84f93dcaf78ec4b2a2aa885f6c0eacd76e85
SHA512

74d47f07c16895abf7da5f3b6db1edc88c70e9aae732fce359039c55553d5a1fb08f46ed29d2d0d8900d50bfb52594ce143ab338b97783196295c6332c124952
SSDEEP

3072:kk6y336Sws+p4wWZPkXLDuIA0JIRWYo+aqJR0w+V4OtBA2yD+9e+3c5kzdCMFFVn:kxg36zWZPk7DuQTfC2jAC9wrnYh

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2300	0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe
2300	0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2300	0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe
2300	0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a7f199cf7a911c107d4d4f612ba3ad1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bhs1352.tmp

Filesize
242KB

MD5
670a30e1dc88da4a50bb0480913983dd

SHA1
2b7afc52c3422587a8a67a0de3f0f357fdb2fdfc

SHA256
b67e2b129c39f2c841334e7f24aeb8868a083a1e66753c137ead74437f21cc33

SHA512
f7970af2493e6bb2c03a66d6730ed4cb9670235c512547312f926d6f16e0b51611faad98cbb6707881c6889af763d2eaa12cfddb3b8fbdbba02f32afcc7b935a

Download Submit
memory/2300-2-0x0000000000430000-0x0000000000472000-memory.dmp

Filesize
264KB

Download
memory/2300-3-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-4-0x00000000022E0000-0x0000000002320000-memory.dmp

Filesize
256KB

Download
memory/2300-5-0x00000000022E0000-0x0000000002320000-memory.dmp

Filesize
256KB

Download
memory/2300-8-0x000000000A990000-0x000000000B136000-memory.dmp

Filesize
7.6MB

Download
memory/2300-16-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-17-0x00000000022E0000-0x0000000002320000-memory.dmp

Filesize
256KB

Download