118d03098fb838ef75127ba41fa817929366619db34843efd9294bbeaa3e42f5

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe
Size

60KB
MD5

01ad1be951a89134a22a2266d4ebf6d0
SHA1

a5c7e9825c740a0e6a629cd81311d4dbcda41467
SHA256

118d03098fb838ef75127ba41fa817929366619db34843efd9294bbeaa3e42f5
SHA512

11121d824419362783c3cac7add44bd0696cd97de2db3ca51dd8189b5b47f8282fd26145d6f0392c2e6dc5a7214ad3ebf05a562955fd51d0359c9f55fd8861a3
SSDEEP

768:rJauNnqHVRVGw5U0+qRRt6cOLRIeu9c8RDKrBloURMJBxhGPq3z5y8W:k5Gkz+qRLWRBX9lC+PqFy

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\78UNQO.exe	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe
File opened for modification	C:\Windows\78UNQO.exe	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2952	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe
2952	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe
2952	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe
2952	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe
2952	01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01ad1be951a89134a22a2266d4ebf6d0_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads