05d8a2eba3818361badac4015359889db6938ccc9b0d6299edd58f5f683678da

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

928f149e576e1ce631ccd0759c3c99ae_JaffaCakes118.exe
Size

219KB
MD5

928f149e576e1ce631ccd0759c3c99ae
SHA1

4b8b45ac2c2abce878400f162a995709835bc436
SHA256

05d8a2eba3818361badac4015359889db6938ccc9b0d6299edd58f5f683678da
SHA512

bb8f855c2effd53ef955c0ea97f7b8b471430fdada8efbb956e9c1bcf01c464f6a7690b4d08614865ed019d8eea977c26a266cea94461f74441ab6ff04727a3d
SSDEEP

3072:f7KtS7GmQGYOS7ccrRbLvN3Qix+tFOR8OODSJ6BsVFH9xTo0YCFYEdnv0Ww9XRmR:+tSHS7FFP4v6Oq6eBTo0YCaEdHwJRmR

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\WaterWell.job	928f149e576e1ce631ccd0759c3c99ae_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\928f149e576e1ce631ccd0759c3c99ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\928f149e576e1ce631ccd0759c3c99ae_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1924-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1924-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1924-4-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1924-3-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1924-9-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1924-5-0x0000000000570000-0x000000000059F000-memory.dmp

Filesize
188KB

Download
memory/1924-17-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download