Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 04:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe
Resource
win7-20240611-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe
Resource
win10v2004-20240611-en
3 signatures
150 seconds
General
-
Target
14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe
-
Size
354KB
-
MD5
14c01629125fa37d04a0e0e86b76a7c8
-
SHA1
e0a8d814eb5788ed0d0eaa915f186eb7bbca2dbb
-
SHA256
6e98c053f9a5fc14c88e63f138faa3296e6ef9b6e9f3b70d16b01d76116d4331
-
SHA512
08b917ce9eaacfed43147dd8063cabdbd2e78cba2d82cea22943035b30c73da7497cb2509e0952facc87bf78b8b7bc4a5f61ce2a3a52443043323f2abb9756e8
-
SSDEEP
6144:Qe5ItnLFrlB/S7KehAshNwRNWJ6pGA0Wk0ZBjeDj9vwE2IkOI3nd:Q3tLFL4GshNaskpd0WNBSDj9vt2r3d
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysguard = "C:\\Windows\\sysguard.exe" 14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\sysguard.exe 14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe File created C:\Windows\sysguard.exe 14c01629125fa37d04a0e0e86b76a7c8_JaffaCakes118.exe