Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 08:00
Static task
static1
Behavioral task
behavioral1
Sample
91098313468eaf26d1eaf7008bef1a3e_JaffaCakes118.jad
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91098313468eaf26d1eaf7008bef1a3e_JaffaCakes118.jad
Resource
win10v2004-20240508-en
General
-
Target
91098313468eaf26d1eaf7008bef1a3e_JaffaCakes118.jad
-
Size
606KB
-
MD5
91098313468eaf26d1eaf7008bef1a3e
-
SHA1
4678a796adaef508e2b0b2e8e42f25357f51cc4e
-
SHA256
f31f5da9429ede7b416cef0fe5040af392f9f382e8d24f8b79a9293455fe6377
-
SHA512
50f11be4ff0f36659372eb0090d66e4e9d297dbb418d42b1652b362911fbfbd27a53800b5de8f9968636e777b769bf085dd2c491c0c9b96e71efca70a1e010bf
-
SSDEEP
12288:fLSOUvshRILrnBGDlWrjk5t3jVi2XlHFonSYElgH526Q:fuO+shRqnwck5RjL/YkgHYH
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2860 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\91098313468eaf26d1eaf7008bef1a3e_JaffaCakes118.jad1⤵
- Modifies registry class
PID:8
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2860