Analysis

  • max time kernel
    141s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 23:47

General

  • Target

    5c1d5414f5cfa977b4191a1ee648d0b9_JaffaCakes118.exe

  • Size

    3.2MB

  • MD5

    5c1d5414f5cfa977b4191a1ee648d0b9

  • SHA1

    fb7a1f4a271912c17f2e3e2768199140b5aa5370

  • SHA256

    967872b5752dc1930ef0e53583ff62ebcfb875e7153dadef7cbfa99d3bd77dcd

  • SHA512

    959c33c3684b696b54496c0cc799f6193d13bc66c4f8b1601c4a4ae3bedf5a55c108e45b2c75ce24934ec02502a732fd4f5c5d9c3898f33de0dc806025e2e715

  • SSDEEP

    49152:vgpBACSQ5hCrqtFKKW/AWAbYrnJdWS5SfTTTJVj:nrqtFKVAW1rnPWS5sj

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c1d5414f5cfa977b4191a1ee648d0b9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c1d5414f5cfa977b4191a1ee648d0b9_JaffaCakes118.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

    Filesize

    28KB

    MD5

    9e076f5e56609bf82956d096a7c8f273

    SHA1

    bf1b3d36b5172cf6793e9abfd2fa73eb82c27e7f

    SHA256

    7e8ad7e17f1ef8a852144be2c947c90979815cc0d6d63c4fd2cadbef436b88e2

    SHA512

    f077b0b62ff5311f9b1b6455fe18870b8ea45f13c451bd3aea99ccca0dd1b02b775af84063b9a96405dff8ef7472271cc34864504dd808d4484c4e8ef79ff58a

  • memory/224-0-0x00000000009B0000-0x00000000009B1000-memory.dmp

    Filesize

    4KB

  • memory/224-17-0x0000000000400000-0x00000000007C9000-memory.dmp

    Filesize

    3.8MB

  • memory/224-19-0x00000000009B0000-0x00000000009B1000-memory.dmp

    Filesize

    4KB