Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 06:44

General

  • Target

    8d32b2c3d155f98762894312c4957ce3_JaffaCakes118.exe

  • Size

    703KB

  • MD5

    8d32b2c3d155f98762894312c4957ce3

  • SHA1

    0b50d03e6516c86b818e2535bf307c276ba3e1ce

  • SHA256

    0d58d006acd828bb27caa96a7c1afca420db03eb73ed479844971d86449ccba2

  • SHA512

    df81bbec7973f3495161fe8eda49b37ec611a6c81518262b3e61227aa68f109ed3771163cbdcf667e9bc6df0ffea3d4f45bc1a9bcb9e9f114d0608f145d1cacb

  • SSDEEP

    12288:4viyjlMsGhLqVjJ/gaTbiO/7hlS85TMalRU24LJgyo/30pFfhdC24W/:8YLqv/gaTbisSqrQL6yoQfhdC24W/

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d32b2c3d155f98762894312c4957ce3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d32b2c3d155f98762894312c4957ce3_JaffaCakes118.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2588-2-0x0000000000640000-0x00000000007C1000-memory.dmp

    Filesize

    1.5MB

  • memory/2588-9-0x0000000000160000-0x0000000000161000-memory.dmp

    Filesize

    4KB