3fdbc985aecaf170a3072e2554c21bbe6a20e6aa2081f52de01fa3d5bf9d4fe0

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02a33d2ac7e59dfaa1c688b58b80af2d_JaffaCakes118.exe
Size

232KB
MD5

02a33d2ac7e59dfaa1c688b58b80af2d
SHA1

ce0aa5ac67e79ebf2af7371108524d39827f2b82
SHA256

3fdbc985aecaf170a3072e2554c21bbe6a20e6aa2081f52de01fa3d5bf9d4fe0
SHA512

184baa1af66a9a8b6e8b214aa1cd4bad61e94a3f56767c20cb0a62437fe06e83256cd84aba63e1edda85f85882c69d47ab467bf7be26fe481cfd77e36a4598ec
SSDEEP

6144:KZuuObR8sVImcyYm8Qlr7hb+1V+XmTBq:ZV+mzkQPS1V+XmTs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	02a33d2ac7e59dfaa1c688b58b80af2d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	02a33d2ac7e59dfaa1c688b58b80af2d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	02a33d2ac7e59dfaa1c688b58b80af2d_JaffaCakes118.exe
2220	02a33d2ac7e59dfaa1c688b58b80af2d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\02a33d2ac7e59dfaa1c688b58b80af2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02a33d2ac7e59dfaa1c688b58b80af2d_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download