193e57b7d048b1cca36a881f2d9cd95a8cce0160836cfe457d772a0601841c02

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa12596ac3b4167976185ad3d7305641_JaffaCakes118.exe
Size

298KB
MD5

aa12596ac3b4167976185ad3d7305641
SHA1

1b01ec9346371684a8d98647748f1e342eab727e
SHA256

193e57b7d048b1cca36a881f2d9cd95a8cce0160836cfe457d772a0601841c02
SHA512

1cff90607b13a22768f4ad507361946f16675a8f8bdfe419ff679f7ce3acd6fb14183e93570ff5bc23389a4841822740daff4b86355a4596ec7239bc22ad4ade
SSDEEP

6144:/AMA0o61Vijo1ohYsO4fTTIYw7vBNo+1+FsHf/lOvccUugde:/ADBhYsOQTTIYwv/tO0Wgde

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\BestSleep.job	aa12596ac3b4167976185ad3d7305641_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa12596ac3b4167976185ad3d7305641_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa12596ac3b4167976185ad3d7305641_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1232-1-0x0000000000030000-0x0000000000032000-memory.dmp

Filesize
8KB

Download
memory/1232-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1232-3-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1232-5-0x0000000000310000-0x0000000000342000-memory.dmp

Filesize
200KB

Download
memory/1232-4-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1232-6-0x0000000000310000-0x0000000000342000-memory.dmp

Filesize
200KB

Download
memory/1232-7-0x0000000000390000-0x00000000003BF000-memory.dmp

Filesize
188KB

Download
memory/1232-11-0x0000000000310000-0x0000000000342000-memory.dmp

Filesize
200KB

Download
memory/1232-19-0x0000000000310000-0x0000000000342000-memory.dmp

Filesize
200KB

Download