92c39e81dd511d9687261d43c4892689fa5380e56acaea1b369fc0cc38fc3c40

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cfa93f9559be885f22ed08e1a7fd783_JaffaCakes118.exe
Size

406KB
MD5

4cfa93f9559be885f22ed08e1a7fd783
SHA1

c3424fa31684df5c7b08b38254b95501bcc1b581
SHA256

92c39e81dd511d9687261d43c4892689fa5380e56acaea1b369fc0cc38fc3c40
SHA512

2a976e32ac35df46ff50e4da174d137bcb6201e94faf1c137bc020264bcfdd5ec5fd53e4e006c5cd124377c228eaf8f0ddba1937ee007e546ea53dc21febe451
SSDEEP

6144:Hs8ZSfWInb7CRu4Ejl6Dh31hMBBDf+mzUmkVdZO+wQMrCQ7sRKU5b2XY+nogvtih:Hs8ZacjCDHzUmkVf/wQo77o+no6Art

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	4cfa93f9559be885f22ed08e1a7fd783_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	4cfa93f9559be885f22ed08e1a7fd783_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	4cfa93f9559be885f22ed08e1a7fd783_JaffaCakes118.exe
2868	4cfa93f9559be885f22ed08e1a7fd783_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4cfa93f9559be885f22ed08e1a7fd783_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cfa93f9559be885f22ed08e1a7fd783_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-9-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download