6074e26993a7a28d4527ec78e6dbb2a97711025dc9ee3788057cbe4551f3c105

General

Target

176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
Size

149KB
MD5

176f3c4b011b48649d3a655df5b0210f
SHA1

cea38112f7148dbd1647acf3bb68da989fffb916
SHA256

6074e26993a7a28d4527ec78e6dbb2a97711025dc9ee3788057cbe4551f3c105
SHA512

28b488fe1b38e391dffd5a049d603b40549b165c413dcc452f8311a92e7e6ef7b767005c032c0263c75f0a331be1c10a8316b2240476491afff1ff07da40f0d5
SSDEEP

3072:ucaJvW8koHjmX+1+0cxxsWEsJ0ifXcIp08MoeTfBkXMAWXDRZdmNHPGt115:ucaJuqVxYT52MZMTpkXM9TRZdTt1f

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\aimcracker.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Windows 2000.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Napster Clone.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Another bang bus victim forced rape sex cum.mpg.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Teen Violent Forced Gangbang.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\password stealer.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\CKY3 - Bam Margera World Industries Alien Workshop.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\divx pro.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\pamela anderson naked.mpg.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\GTA3 crack.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\DivX pro key generator.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\icqcracker.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\crack.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Warcraft 3 battle.net serial generator.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe	176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\176f3c4b011b48649d3a655df5b0210f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif

Filesize
72KB

MD5
e625a3709a404e9836772851e11a11c7

SHA1
63815e91787b48ac372dbc6e8b444e686a61a51e

SHA256
4f97b27fd913ebf63598d62e71e9c72e30b0b1fa9bb024a56d8a411408356997

SHA512
5f8d4b4da88ccd2f2ab129d34bcf21849ca244698e9963a9b50cded371d63f3f4878fc98c39e66b772bb5c98ebabecd879736a5f9f70f7fb5c70464d9cee7a31

Download Submit
memory/1784-27-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads