Analysis
-
max time kernel
132s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:56
Static task
static1
Behavioral task
behavioral1
Sample
69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe
-
Size
129KB
-
MD5
69114344c59a93de20b6bdb2fd0d5618
-
SHA1
f8ee5ac1527d75c3170ce9750454b3e5445228fd
-
SHA256
23098013a14afd2503f37adcf5aa22c23d4411ae43010cac0049daaaf506e027
-
SHA512
c0ce4676f7c1c33a197f7ec7681f72e0f746a63ed590e8432c502e95d14eb77a1eaab4a0e2f181c707ffa25ac2d9da4416234243c25cc471d85caa672a73d9d5
-
SSDEEP
3072:ucaJvW8koHjmX+1+0cxxsWEsJ0ifXcIp08Moed5YGZ:ucaJuqVxYT52MZMf/
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe -
Drops file in System32 directory 27 IoCs
Processes:
69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\aol password cracker.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\DivX pro key generator.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\Want to see a massive horse cock in a tight little teen's pussy.mpg.pif 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\virtua girl - adriana.pif 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\Britney spears nude.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\Teen Violent Forced Gangbang.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\winxcfg.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\jenna jameson sex scene huge dick blowjob.scr 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\icqcracker.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\15 year old webcam.mpg.pif 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\siemens unlocker.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\AIM Flooder.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\invisible IP.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\hotmailhacker.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe File created C:\Windows\SysWOW64\macromd\Pamela Anderson.exe 69114344c59a93de20b6bdb2fd0d5618_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pifFilesize
78KB
MD50afab2032ede1f9c6749bc85a3adf410
SHA1387b29854665ecbc7e7f4563ad5689b14d9819d9
SHA256dbe1f85b1f39d879783f47d4afd738ab024852859a910f2ae8a308cbe7d91c80
SHA512598d8a5113b55cf0f2629833d906b7e266b08a121bf6c5207c0b91e8d7bdb1a1bb4361c96ae3b9ed2bfce7a6af114f673a2f73ea895320eff102e268b1374b14
-
memory/4892-27-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB