Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-05-2024 04:54

General

  • Target

    0d8edf024270ce15befa0357bfd1cfd9_JaffaCakes118.exe

  • Size

    27.8MB

  • MD5

    0d8edf024270ce15befa0357bfd1cfd9

  • SHA1

    90e067f156bc0b21d27d9ad0849c3f1135e93ace

  • SHA256

    eb0c422644a48a7c2a5c97beef3880582160cd99aa28eec91bed2913569595fc

  • SHA512

    79f835e2726f59956c2ed1634defa769adc61709066a4b0c8724f1f0d9f6d978378feb506db47b68cca07c1f487433eb93fed4b25bf88f1c4519b04fd2acbb97

  • SSDEEP

    393216:kQ8+o2u0GYbvCmNIhPCb4K1IkBts/mvdLqFF0qrQ:

Malware Config

Signatures

  • FakeAV, RogueAntivirus

    FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

  • FakeAV payload 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d8edf024270ce15befa0357bfd1cfd9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d8edf024270ce15befa0357bfd1cfd9_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:4644

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4644-0-0x0000000001E90000-0x0000000001E91000-memory.dmp
    Filesize

    4KB

  • memory/4644-5-0x0000000000400000-0x00000000004BD000-memory.dmp
    Filesize

    756KB

  • memory/4644-7-0x0000000001E90000-0x0000000001E91000-memory.dmp
    Filesize

    4KB