c400edd4929589dc3d9e020128938d8f5b0a0771564be4a6e5113cfbe3fad7f6

Analysis

max time kernel
113s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
Size

154KB
MD5

b12b63f768c41edd58e27cfb116a5f7b
SHA1

27fc998c372cb149fe66667db398fce1e8846f81
SHA256

c400edd4929589dc3d9e020128938d8f5b0a0771564be4a6e5113cfbe3fad7f6
SHA512

7f74f0bd39292e04c53edcaefc98441775a7222b9bddbd0f64e964dd1503dc6ff8d6d7a1cfe40f813980bfcd5ba9e35d6984b5a7eaf721207826bf66aac6e823
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08MoeiS3w0vL+u:aM7jJlRexYTHYZM53w8L+u

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\uncle fred spanking his young nieces little ass.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sexy star kate hudson nude.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\siemens unlocker.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\busty older bitch gets slammed.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hot mature blonde in stockings.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\busty asian with big lips.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\petite ebony enjoying her joy toy.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\firm ass honie with thick lips made for sucking rods.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\blonde with titts and cunt sending chills thru cock.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\two kinky old lezbos snapping the whip.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\slutty japanese babe giving blowjob.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\CKY3 - Bam Margera World Industries Alien Workshop.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\cute teen fingering herself on the sofa.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\asian studys how to strip.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\toying blonde with fucking machine.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hotmailhacker.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\black dude gettin it with two white hoes.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\candy stripper getting down on sick mans cock.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sexy hot teens gettin busy in shower.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\asian getting a taste of pork.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Norton antivirus 2002.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\shy teen draining the juice from 2 cocks.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\extremely fine hoine with incredible sweet twat.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\brunette fucking in bedroom with boyfriend.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\crazy old man playing young teen.mpg.pif	b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b12b63f768c41edd58e27cfb116a5f7b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe

Filesize
97KB

MD5
b621b52105aa105107532617b6137262

SHA1
4dea7dfe5e71e810c74820383650c2d7b0358eea

SHA256
0f1f51a90c776a0fe02cf1636c0a8d54eb53a18e56acb600c969f4756f6993cd

SHA512
3ec9a06e0b821d9b641a5276514c305e6e25f0952df358a86f504821cce4726adb077043faa3d050f643e46efc6438a2a41ed8c16b14e9a8773f28ac8d82678e

Download Submit
memory/1368-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1368-34-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads