113d51dbb4bf56836ef1690185fce3a4e4f3d1ed2a04b2fecd4f1a75ff42f6be

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

102b557965abe3908fd8635517e17439_JaffaCakes118.exe
Size

222KB
MD5

102b557965abe3908fd8635517e17439
SHA1

701d30451f48b05dba25efadb4b475857bfc5fab
SHA256

113d51dbb4bf56836ef1690185fce3a4e4f3d1ed2a04b2fecd4f1a75ff42f6be
SHA512

73f7e7efff1ce45c688254605d226a9641a275f8534cef94a29f6a55248c90bbeadea9fc18efd8e77b4294447b02b192b2bc3dd839f4e72832b826ee19de3c2c
SSDEEP

6144:u63D9EhRBNkJk5M2y7ic26/R9V4BWc/Ye:PoRDLw5/fc/Ye

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\PasswordMash.job	102b557965abe3908fd8635517e17439_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\102b557965abe3908fd8635517e17439_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\102b557965abe3908fd8635517e17439_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-4-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2168-9-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/2168-5-0x0000000000240000-0x000000000026F000-memory.dmp

Filesize
188KB

Download
memory/2168-3-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/2168-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2168-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2168-17-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download