c37a85b367b72d71ee8a7e8d278b1e3aca147e13b078bd0545393100a19a57ab

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07afb84baa456c5f1d38deb89e4f65ef_JaffaCakes118.exe
Size

133KB
MD5

07afb84baa456c5f1d38deb89e4f65ef
SHA1

ffe27f09fd554d1167950136097a141857969803
SHA256

c37a85b367b72d71ee8a7e8d278b1e3aca147e13b078bd0545393100a19a57ab
SHA512

86d659427148f61228ee60886b5d4b6cabb307e1bc573f8b02345e1972d04d30584f4fb6697ba56ccdf1e18c137647d567e23f80dd975e56bc166e5405526c06
SSDEEP

3072:+2fJehebp8MtbXLxNYwEyuEdgzeHTYEzcJk7FFxElW2:+2Ked8cbc1jEPTYEAJQfulW2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	07afb84baa456c5f1d38deb89e4f65ef_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1876	07afb84baa456c5f1d38deb89e4f65ef_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1876	07afb84baa456c5f1d38deb89e4f65ef_JaffaCakes118.exe
1876	07afb84baa456c5f1d38deb89e4f65ef_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\07afb84baa456c5f1d38deb89e4f65ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07afb84baa456c5f1d38deb89e4f65ef_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download