0516aeba537da316f52e8756f2c718a64944ca8a6da450f706e09e2bc02eb1ea

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2877f5dacd809f67d0ba7e77b448751f_JaffaCakes118.exe
Size

220KB
MD5

2877f5dacd809f67d0ba7e77b448751f
SHA1

e61939740db3125cf04936d78612dbf8bd99e72b
SHA256

0516aeba537da316f52e8756f2c718a64944ca8a6da450f706e09e2bc02eb1ea
SHA512

60547edab4e20a44cd4228fbd37b83c6c6bc203e3635f990a0a44219feb27fcd572d7b51c942928ebf98b34a569b3c4a7922db84f1b59a621dfde78ae0803e36
SSDEEP

3072:bQGC2vR6eJobccrLtMIMaGMPQ+8UXkVXFT6FR030/CvtibJEzxvaC3xsqq98TCzk:cGlUDbFS5UXkVoWvkbcxVOr9aCsYmv

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\IronKeep.job	2877f5dacd809f67d0ba7e77b448751f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2877f5dacd809f67d0ba7e77b448751f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2877f5dacd809f67d0ba7e77b448751f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1612-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1612-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1612-4-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/1612-9-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/1612-5-0x0000000000150000-0x000000000017F000-memory.dmp

Filesize
188KB

Download
memory/1612-17-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download