fcc78fedd05afb39f5c3a43f190d7a72846b5f57bcecaaf6b3c36d737d91ad52

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
Size

144KB
MD5

ac5d1946d671b5db289ae675b8c7522c
SHA1

ce445d6aaf2beaedf99a64909fe8fa827ddf5f76
SHA256

fcc78fedd05afb39f5c3a43f190d7a72846b5f57bcecaaf6b3c36d737d91ad52
SHA512

80e77247f27182007f937f7853cc7cb4b612d6768bfb2a9fbe48f750e3c9b0ffeb26fcd9120aeeba0338d61ed9f707246933e366f47ffd7cbb5bc074a5c9880e
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08MoeGA6EJQ2b7:aM7jJlRexYTHYZMh6l2b7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\illegal preteen porn anal fisting.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hot anita blonde doing lesbo.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\2 old heshes playing with each other.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sexy pink pussy girl taking it off.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\uncle fred spanking his young nieces little ass.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\babe doing boyfriend and his buddy.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\large lesbo sluts in bondage.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\tiny little virgin showing off her cherry pussy.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\schoolgirl deep sucking some cock.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\XXX Porn Passwords.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\tiny girl opening hole in crazy wish of cock.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hairy lezzies torching it up with hot candles.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\redhead with a shaved beaver.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\virtua girl - bailey short skirt.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\amateur spreading more fine ass than stud can handle.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\icqcracker.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\ebony spreading her pink wet pussy.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\holes fisting to the breaking point.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\honies with incredibly delicious big boobs.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hot mature blonde in stockings.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\older blonde showing she has the goods.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\an ebony shemale showing her hose.mpg.pif	ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac5d1946d671b5db289ae675b8c7522c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe

Filesize
89KB

MD5
d3d5a1ee7703642fd63e22bde112558e

SHA1
0f710c6c2e4b11a68a1ebb1908aee091172c285b

SHA256
f7534601145048a2caa7e6d9165d8f237a9e4749c208a0f143cfb26eeb48e1b4

SHA512
d13f01d03142f91b982ae12bf65d80f59412ab165895b4067e7777532aa43dd43e3e63bc9797b5be6fea481df444b0b3e277c9b9e5c7e43c385c6e5b20de1360

Download Submit
memory/728-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads