7ccea256efc12bb1bdf6bfc282840b8722a4f621ee9649a43f93bcbf6a937746

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

149c09929cb0db3cc3a58f1501a3c9e7_JaffaCakes118.exe
Size

422KB
MD5

149c09929cb0db3cc3a58f1501a3c9e7
SHA1

54529f323a5127c675e56fd9f1a22b3d0254eaed
SHA256

7ccea256efc12bb1bdf6bfc282840b8722a4f621ee9649a43f93bcbf6a937746
SHA512

36eb5950e45e48d471bbb45335099451fdef3cd40934dbe79a935ad71230a210389935886bc99380d4d575985e7eedf5d5194fb413fa27e788fb27f148495738
SSDEEP

12288:n5lVkUbZIRQm2N43IEvK+S2f7W8fNUr6:n3VkUWR52Yv22f7WSNUr

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	149c09929cb0db3cc3a58f1501a3c9e7_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	149c09929cb0db3cc3a58f1501a3c9e7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\149c09929cb0db3cc3a58f1501a3c9e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\149c09929cb0db3cc3a58f1501a3c9e7_JaffaCakes118.exe"
1⤵
- System policy modification
PID:1224
- C:\Users\Admin\AppData\Local\Temp\AUTMGR32.EXE
  "C:\Users\Admin\AppData\Local\Temp\AUTMGR32.EXE"
  2⤵
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-0-0x0000000000400000-0x000000000046FC00-memory.dmp

Filesize
447KB

Download