45376edce7e6a87f517f0e03166d2d29a8d41c778bb493bf9ca48bafba2972f5

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09eaecd99f0260295c4761668a59dd21_JaffaCakes118.exe
Size

395KB
MD5

09eaecd99f0260295c4761668a59dd21
SHA1

14bb0cfe64d79e3d7712bcf35a208d1f71048515
SHA256

45376edce7e6a87f517f0e03166d2d29a8d41c778bb493bf9ca48bafba2972f5
SHA512

c7c3282506822150b5bd239046c5140bd12135acc9e4a0d9250de867d293f0acbc40ab4c34bf139a28b26c12a217b0449be28233fde68eab32efae0ae38204d3
SSDEEP

6144:gs833CnotE7RN8JmrwW9Na7coMGHUWO1a29gpclC2FVPbGm2Tle:mLtE7RafhJIag42HqY

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System-Service = "C:\\Windows\\SYSTEM\\EXPLORER.SCR"	09eaecd99f0260295c4761668a59dd21_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SYSTEM\EXPLORER.SCR	09eaecd99f0260295c4761668a59dd21_JaffaCakes118.exe
File opened for modification	C:\Windows\SYSTEM\EXPLORER.SCR	09eaecd99f0260295c4761668a59dd21_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\09eaecd99f0260295c4761668a59dd21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09eaecd99f0260295c4761668a59dd21_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\sys32\$$FREE$$ .exe

Filesize
440KB

MD5
fb8beb6c0b1c68380b2e3119670b10a3

SHA1
76f4d76c3aea4f144f19e587ae7159f2fe624287

SHA256
826c115d3b9c289b86a8a610bb5f3979a4aa3f114435353815092ca4f8a5478f

SHA512
67462d07efab7fb99941d8da9fdf92aab9bbb8a353041ac0e93b30643658ca0c1e3f08c90edf5707e6dd37da43f4957f307bdb42b99ed5aa8650a017b2f98e00

Download Submit
memory/2688-33-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/2688-2-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-14-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-0-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/2688-49-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-62-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-78-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-91-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-107-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2688-118-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads