320619d1fe666cd98dfd9a380831e7a31b11477423d2783fba18cc0a384b3c0e

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe
Size

505KB
MD5

a6ee5747ab466e44b9b097c83f79ab64
SHA1

ad3bacbc39346bf89a4c53e78b879152aa06ebf9
SHA256

320619d1fe666cd98dfd9a380831e7a31b11477423d2783fba18cc0a384b3c0e
SHA512

7a12bb858232e0d80b036bd5af8e2762410bda1bb3771969c5d03316915dbd86e1acbd27945e1e23fece3b41920ce170c9f8ca1fa108e8d865d7c59ce718f7b8
SSDEEP

12288:l6QTlw7u7eAefuwA8dzQD1NYYueR10lFu:l66OS7lwAf/z5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1548	a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe
1548	a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1548	a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe
1548	a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6ee5747ab466e44b9b097c83f79ab64_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\jki31AB.tmp

Filesize
405KB

MD5
c1a74ba246610086f56d11f967239c27

SHA1
02fc117f8f111320fd4d40e3136b8126e3f411ca

SHA256
411397f27c20f474a8e388a80a02859a26299c2c2bb519d61000eb34620f1be7

SHA512
6eba4ec75aaa4ffcb2418e47b2c1bde0b5b03e360914fb60f89543bdf57f9ffdf707ce33061c41e7759a2e1b0199a3d20427a5e3e11c72220fed39935c2f6f04

Download Submit
memory/1548-9-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-5-0x0000000000350000-0x00000000003BA000-memory.dmp

Filesize
424KB

Download
memory/1548-6-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-7-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-8-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-1-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/1548-12-0x000000000A360000-0x000000000AB06000-memory.dmp

Filesize
7.6MB

Download
memory/1548-20-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/1548-21-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-22-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-23-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-24-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download