479d8c38ed722fa0ca2d5496ab80e093103c1a3092b91fe69495ed1f33a060d2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 10:47

Target

a06182cf0b08bda8e4c9e44c3a5c9be4_JaffaCakes118.exe
Size

1.3MB
MD5

a06182cf0b08bda8e4c9e44c3a5c9be4
SHA1

e688de0533b09b384ab1f6e374b5a0a89962fdec
SHA256

479d8c38ed722fa0ca2d5496ab80e093103c1a3092b91fe69495ed1f33a060d2
SHA512

d6723fc61ba1048f34556f6d52e7c2af6f9e1cf0d3c82db2122f475dde1bb1155af295844503b4245da6b1ab62a1edd82ee84ea0db40f65bd769dec2e21e93e2
SSDEEP

24576:7xmvPWClcf4HjIjOy86kX+33OpfPFmcyou7dNnEp22222222222222222222222a:7NClcQHsj6o3+pfPFmcudNnEp2222223

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	a06182cf0b08bda8e4c9e44c3a5c9be4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	a06182cf0b08bda8e4c9e44c3a5c9be4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	a06182cf0b08bda8e4c9e44c3a5c9be4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	a06182cf0b08bda8e4c9e44c3a5c9be4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2196	a06182cf0b08bda8e4c9e44c3a5c9be4_JaffaCakes118.exe
2196	a06182cf0b08bda8e4c9e44c3a5c9be4_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html

Filesize
10KB

MD5
02cc14db2683ca50e183001388945002

SHA1
6b7f177f7a67cbb203faef647613cfaa478234c3

SHA256
d267e3eb28ef39a6a8eea4b65ff3466ac5f38bbd92ec261a2b2b970274badeb6

SHA512
d9f458817b6d43e8fa282eb5d7110bad9ccfe6230df1205a10342d02e63ebc1579a9341342108f6754a7b28d961262e79ef945facaa93da1d403aef001bb75be

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js

Filesize
202KB

MD5
a4fdd77e182bd2fabe300a47b5617a35

SHA1
e002b335c75b5edefcd251962f61f53a2ab8e0f2

SHA256
8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b

SHA512
ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js

Filesize
89KB

MD5
219073097031d9c1a95a1291d66f3a10

SHA1
2b7996b01d90b7f424f2a2e6063947461db4b2b2

SHA256
232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef

SHA512
9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

Download Submit
memory/2196-0-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download