4f0f647ea16b91800e748ecdd451d9938a67f84cd1a84482255e65b5362b02e5

Analysis

max time kernel
143s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 09:39

Target
0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
Size 2.2MB
Sample240625-lm15basbje
SHA256 4f0f647ea16b91800e748ecdd451d9938a67f84cd1a84482255e65b5362b02e5
MD5 0d94e989d94b06443df53adca9e7eeb4
SHA1 384bafea2e830d17495ddcb5e528f451a197cbf6
SHA512 893f21d0c4628912180f84d22fb838a98157eeb2b56fa7f61e0666f7b580c2fcc01a296a7c8e2cead9dd0a212ccce5a04877070d78f7735cc84daa0040ede361
SSDEEP 49152:Co23XRf87l7ys98zn8ydzntBDJomIWvZpXPZbnxGYDrC1IQmRqoQZfYn:Co23J879d98rrntRtIWvZppxlyy+An
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Menu Iniciar\Iniciar\WindowsUpdate.exe	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
File created	C:\WINDOWS\update.ini	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\SysWow64\\WindowsUpdate.exe"	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Windows\CurrentVersion\Run	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4568	0d94e989d94b06443df53adca9e7eeb4_JaffaCakes118.exe

memory/4568-0-0x0000000000400000-0x000000000329B000-memory.dmp

Download

memory/4568-1-0x0000000003470000-0x0000000003471000-memory.dmp

Download

memory/4568-2-0x0000000000400000-0x000000000329B000-memory.dmp

Download