1e4767b28d1da6b6f12b893773e1ec6687255594e601a930b021e726f2d21691

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Size

116KB
MD5

087804a468dd5209e42f6bedbab30dbe
SHA1

9f3aad7af59847d56391779f6919ca743d5e57b4
SHA256

1e4767b28d1da6b6f12b893773e1ec6687255594e601a930b021e726f2d21691
SHA512

5c451da71ef0d492538e50a672bcc9d7d2028c94efc7a7629f94bce02e6b367c8d786708d73f242edc7caf63beb24d6924dcb75259a82058c7f9a4f810d49274
SSDEEP

3072:CBKwcvdwuxdWikJYhF6agBh16260J7z7oR2I2Za1w:CBKwcvdnpFvgBhM260dcR2IOa1w

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\087804a468dd5209e42f6bedbab30dbe_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-0-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1784-1-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download