2257ab87e07c32580239d56899e57a5c4d0cce2bd8f56fb001f990fa832d4f0b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d10f3ab37976b4a29ff7b235284eeca_JaffaCakes118.exe
Size

362KB
MD5

0d10f3ab37976b4a29ff7b235284eeca
SHA1

af6e58091985e153aa9a71e159221aa23e7d6f21
SHA256

2257ab87e07c32580239d56899e57a5c4d0cce2bd8f56fb001f990fa832d4f0b
SHA512

725044cdaf41756fe0db5a1dfac1f25511bc1d2399bf40da6edb51752d2a1bde9976cad15fcb7f9369b276d4d15a6b4d033e547fdb3ec9bf17e7382a71930872
SSDEEP

6144:jYRWftXRCyLE61AiSYztWlQS+N4OwfuVRsCGN8xzfUyo6oSwtLK0ZJGg:xhhLEGStlQS+N49iGNQfUyboSw08T

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	0d10f3ab37976b4a29ff7b235284eeca_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	0d10f3ab37976b4a29ff7b235284eeca_JaffaCakes118.exe
2392	0d10f3ab37976b4a29ff7b235284eeca_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0d10f3ab37976b4a29ff7b235284eeca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d10f3ab37976b4a29ff7b235284eeca_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\http_404_webOC[1]

Filesize
6KB

MD5
92ab50175c4b03970f264c637c78febe

SHA1
b00fbe1169da972ba4a4a84871af9eca7479000a

SHA256
3926c545ae82fc264c98d6c229a8a0999e2b59ed2bb736f1bda9e2f89e0eeac8

SHA512
3311f118963ad1eaf1b9c7fb10b67280aae1ab38358aed77c10f2587100427af58c7d008abb46ad0f59880ac51e50b5a53fc2c2a96d70f5ece4578ab72382b7a

Download Submit
memory/2392-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/2392-17-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download
memory/2392-18-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download