256cf9b068c9db92d6a70ca4c3ce99c40a64a3571ec4743f282c65297ce5e1a5

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:23

Target

63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe
Size

448KB
MD5

63c69afe79522f175ac1811470df2b0d
SHA1

e4720022b62f2e52c594b2c792094262f019bd9c
SHA256

256cf9b068c9db92d6a70ca4c3ce99c40a64a3571ec4743f282c65297ce5e1a5
SHA512

ebd00a9a9654d611f1969d69e253d09ba8ac41a3f2ca194706294e170a90a3ade47dc3551a468e7246ed81cf446b0763aa5c0327ea21a7a964a1f88e12da291f
SSDEEP

6144:d0PCRT5LgXEhN7th62W4hPpmM7wyxGV6jQ6100nmK1r8iw49cCiKkYxn:XgXEhxth62phxB7wyxGV6Z/4N49cCrRn

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

installer.exe

pid process

2272 installer.exe
Loads dropped DLL 1 IoCs

Processes:

63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe

pid process

1804 63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

installer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main installer.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

installer.exe

pid process

2272 installer.exe
2272 installer.exe

pid	process
2272	installer.exe

pid	process
1804	63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	installer.exe

pid	process
2272	installer.exe
2272	installer.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe

description	pid	process	target process
PID 1804 wrote to memory of 2272	1804	63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe	installer.exe
PID 1804 wrote to memory of 2272	1804	63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe	installer.exe
PID 1804 wrote to memory of 2272	1804	63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe	installer.exe
PID 1804 wrote to memory of 2272	1804	63c69afe79522f175ac1811470df2b0d_JaffaCakes118.exe	installer.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\DM\parent.txt

Filesize
448KB

MD5
63c69afe79522f175ac1811470df2b0d

SHA1
e4720022b62f2e52c594b2c792094262f019bd9c

SHA256
256cf9b068c9db92d6a70ca4c3ce99c40a64a3571ec4743f282c65297ce5e1a5

SHA512
ebd00a9a9654d611f1969d69e253d09ba8ac41a3f2ca194706294e170a90a3ade47dc3551a468e7246ed81cf446b0763aa5c0327ea21a7a964a1f88e12da291f

Download Submit
\Users\Admin\AppData\Local\Temp\DM\installer.exe

Filesize
8KB

MD5
7681013beb29513fc0a90e74468d41bf

SHA1
9c6c1a8a847b0a1bff6a659e0b2b208f79518f1f

SHA256
5db052b7a5d7e3651ebb6053fcfbc81e90c3e207b7b7f8cd2473668f3637cc3b

SHA512
be6449f71e60d98080432c7aba14a68db0c7b6ff083295b2cd1d67e6f201b0566e446790b5041cdcd7f647d4d869379ec9ef1f0842910bab13852b6240582fbc

Download Submit
memory/2272-3-0x000007FEF5DAE000-0x000007FEF5DAF000-memory.dmp

Filesize
4KB

Download
memory/2272-4-0x0000000000750000-0x0000000000792000-memory.dmp

Filesize
264KB

Download
memory/2272-5-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2272-6-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2272-13-0x0000000021050000-0x00000000217F6000-memory.dmp

Filesize
7.6MB

Download
memory/2272-18-0x000007FEF5DAE000-0x000007FEF5DAF000-memory.dmp

Filesize
4KB

Download
memory/2272-19-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download