6e7867df81c517aeb1831bd220ae7c2b8627a2249275f1c99931e1c11ada1c17

Analysis

max time kernel
140s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26fb945fd2fb6968fc1411fcc2e88be3_JaffaCakes118.exe
Size

209KB
MD5

26fb945fd2fb6968fc1411fcc2e88be3
SHA1

97d4423c9c859760a63381f9590a5ca23d759ddd
SHA256

6e7867df81c517aeb1831bd220ae7c2b8627a2249275f1c99931e1c11ada1c17
SHA512

9ab23e98339d06a0d7dd2e8a68a9088c516ed0737bdaa64c26d786733480ef7ba727846fdcc5a02a4f6c5ac9e27e68db0d7b7371031554c6c6890a2a66bee039
SSDEEP

6144:dIZJBAHrZg0vHjiwweaXmJtLCrOPb+c5RT6OJhoobHeye+:YAFg0f+Aak5CiP6cLbJ3Dg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1740-0-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1740-21-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	26fb945fd2fb6968fc1411fcc2e88be3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1740	26fb945fd2fb6968fc1411fcc2e88be3_JaffaCakes118.exe
1740	26fb945fd2fb6968fc1411fcc2e88be3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\26fb945fd2fb6968fc1411fcc2e88be3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26fb945fd2fb6968fc1411fcc2e88be3_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1740-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1740-21-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1740-23-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download