975f85036f827241e4bb35f9976e761ed376b683709059b283f59f637e575b90

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29a666ef669deae468853f7b47c133a0_JaffaCakes118.exe
Size

40KB
MD5

29a666ef669deae468853f7b47c133a0
SHA1

626ee72d8aa0a00d45c566146e187009258fd106
SHA256

975f85036f827241e4bb35f9976e761ed376b683709059b283f59f637e575b90
SHA512

8ba1ebaa4ba138e66748fa21d45bec15119b43908064f1d0f60e77c9210dcb5e8c09d9d52f2a18588186d1eaf0afad4c002e05e4b4117bdfc879272bb00b896d
SSDEEP

384:/TPpL7KzzF8HJYZ2vD9iVyZVNiTTWDjWP:/tLuF8Hc2kkZ20KP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	29a666ef669deae468853f7b47c133a0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2512	29a666ef669deae468853f7b47c133a0_JaffaCakes118.exe
2512	29a666ef669deae468853f7b47c133a0_JaffaCakes118.exe
2512	29a666ef669deae468853f7b47c133a0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\29a666ef669deae468853f7b47c133a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29a666ef669deae468853f7b47c133a0_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2512-10-0x0000000004F10000-0x0000000005257000-memory.dmp

Filesize
3.3MB

Download
memory/2512-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download