Analysis

  • max time kernel
    133s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 06:44

General

  • Target

    8d32b2c3d155f98762894312c4957ce3_JaffaCakes118.exe

  • Size

    703KB

  • MD5

    8d32b2c3d155f98762894312c4957ce3

  • SHA1

    0b50d03e6516c86b818e2535bf307c276ba3e1ce

  • SHA256

    0d58d006acd828bb27caa96a7c1afca420db03eb73ed479844971d86449ccba2

  • SHA512

    df81bbec7973f3495161fe8eda49b37ec611a6c81518262b3e61227aa68f109ed3771163cbdcf667e9bc6df0ffea3d4f45bc1a9bcb9e9f114d0608f145d1cacb

  • SSDEEP

    12288:4viyjlMsGhLqVjJ/gaTbiO/7hlS85TMalRU24LJgyo/30pFfhdC24W/:8YLqv/gaTbisSqrQL6yoQfhdC24W/

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies registry class 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d32b2c3d155f98762894312c4957ce3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d32b2c3d155f98762894312c4957ce3_JaffaCakes118.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2740-2-0x00000000016D0000-0x0000000001851000-memory.dmp

    Filesize

    1.5MB

  • memory/2740-9-0x00000000013F0000-0x00000000013F1000-memory.dmp

    Filesize

    4KB

  • memory/2740-11-0x00000000013F0000-0x00000000013F1000-memory.dmp

    Filesize

    4KB