4ee2754bf9eb9c9367cf87dc75fae65b849dc76df1d6f8e60e7f71c685da5ce8

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4425fbcaa13b0f17886ce8d6c0b5bf5b_JaffaCakes118.exe
Size

2.2MB
MD5

4425fbcaa13b0f17886ce8d6c0b5bf5b
SHA1

700a91a7e1bb28e0608acce56f84ea92c330578d
SHA256

4ee2754bf9eb9c9367cf87dc75fae65b849dc76df1d6f8e60e7f71c685da5ce8
SHA512

f8633869c4e06a5a3c398b90875178ceb0e5bca6cb7491bc5d9bbcf8e8389a39527b2a9cc177ef4ca4c41d959ea6a4940faf746cb0e713645ea71ba075b101e4
SSDEEP

49152:4J0V1egoeBlfJZWYAiVRcINd+ipB2vf9ETvSsR3K01kkH/53CgUZ0R:4CVQgbdzbA2dpyE+QK01hH/53Cg5

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3860	4425fbcaa13b0f17886ce8d6c0b5bf5b_JaffaCakes118.exe
3860	4425fbcaa13b0f17886ce8d6c0b5bf5b_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4425fbcaa13b0f17886ce8d6c0b5bf5b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4425fbcaa13b0f17886ce8d6c0b5bf5b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C216B401\_Setup.dll

Filesize
399KB

MD5
a9018433f15665642006c92d60301e88

SHA1
f8f85be3234c442d576d4ef1a47956554447d6fb

SHA256
d6f9cb503cc24968a21da1f0629bda6ee7e83fe5ac9052bfffcd6b4c1047682f

SHA512
da58563dd6c84ddb7986bb5935a01151e23118b5e4da02a40c45b296131dc981936bcbafabf14e07d09c79ad6e6215109aeddd05bf450219b6a3e2aa79f50762

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tsu8626B6CE.dll

Filesize
284KB

MD5
0f97d203cacd6c39d6fe6cdf0a76b0f3

SHA1
010cae01311ee70ab6ce3137f4993844bf90e657

SHA256
b084175b088c09749000ce331ef51617941c26ce9fec6133e79d8df3f5ea576e

SHA512
d677214e62071a0709b28fa9c944a8139f9dc61febcab2ae098badfa6cbb6f7973951c54aa235058979449d5abf9f728e71fb4b7108114a2b7bd14bc8bc00455

Download Submit