32ef648c9403d758b4a43cb654c9631fe94da70027cb2b6ff44bbe0f61c5f98a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe
Size

2.6MB
MD5

797b51235b8883312051c1b7b7f1e1e6
SHA1

78246857b530ed1e6f8b8cf433182e769a8dabca
SHA256

32ef648c9403d758b4a43cb654c9631fe94da70027cb2b6ff44bbe0f61c5f98a
SHA512

0525466b96f11e3b0b6982c758b78ca68fd6c83bdbf5da6dca41ab3b13ab5ab8b2900d3107852639abe3fa88a1a05fb20f4abd64fece199b3eae638b83d9f854
SSDEEP

24576:ABoyQv4D1p5qLEKpzqZVPrZkZU0WSBmSmMuRosT4tziZPhTT9l/Q71dxLrIUy5h7:D3v45AETI/WSISmpmziTRU8bcoyVnXm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2408	797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2408	797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe
2408	797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\797b51235b8883312051c1b7b7f1e1e6_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2408-5-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/2408-6-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download