11cb81a27a30086731eb42521a6b55566dbe3850d2460322eced2eeeb190b4eb

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6954cecaa4fd3720b88a85aa98f29484_JaffaCakes118.exe
Size

315KB
MD5

6954cecaa4fd3720b88a85aa98f29484
SHA1

b9444c48731f938e9140b5d583ebeb027c179b6b
SHA256

11cb81a27a30086731eb42521a6b55566dbe3850d2460322eced2eeeb190b4eb
SHA512

17e28813894400928dc7d4e23e4e3da731a5ac2f2aea99f5dfbaf56a25a4246a94b939652f3480be63c49e6c3497eab295c84251fd569eb9a9a93709958219d1
SSDEEP

6144:SKRb8KETxr3ABWj0afa3eDmCPZFkTGVvOV6mWDeOoD:5RwK5Woay3eHFY8vMcKOoD

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

6954cecaa4fd3720b88a85aa98f29484_JaffaCakes118.exe

description ioc process

File created C:\Windows\Tasks\KeepMyPass.job 6954cecaa4fd3720b88a85aa98f29484_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\Tasks\KeepMyPass.job	6954cecaa4fd3720b88a85aa98f29484_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6954cecaa4fd3720b88a85aa98f29484_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6954cecaa4fd3720b88a85aa98f29484_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2872-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2872-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2872-4-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/2872-5-0x0000000000150000-0x000000000017F000-memory.dmp

Filesize
188KB

Download
memory/2872-9-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download
memory/2872-17-0x0000000000110000-0x0000000000130000-memory.dmp

Filesize
128KB

Download