1a47250f7274f82a5dfef162a4209be668c62e2997a92b69025602f686287d72

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b8bbbc7d30a574da9cf63e29bbbed9e_JaffaCakes118.exe
Size

7.5MB
MD5

2b8bbbc7d30a574da9cf63e29bbbed9e
SHA1

a659fbfc42a54c525f06ef78a3e4162a14bba544
SHA256

1a47250f7274f82a5dfef162a4209be668c62e2997a92b69025602f686287d72
SHA512

c5c544ff739f7d3d51c814f12f7916aa4b11bbb72629119067a6bfd0cdef232c0ed14f4141ed939fb5f9b01720adb2eca1b0fc327fdaa4baeca2203852a5cfbf
SSDEEP

196608:W4CPs+Z1Riju9tYuQ/sbpRSB7T5cD4Ypw32ze:bCPp1RsVL/sSZ5g4ree

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	2b8bbbc7d30a574da9cf63e29bbbed9e_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	2b8bbbc7d30a574da9cf63e29bbbed9e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1972	2b8bbbc7d30a574da9cf63e29bbbed9e_JaffaCakes118.exe
1972	2b8bbbc7d30a574da9cf63e29bbbed9e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2b8bbbc7d30a574da9cf63e29bbbed9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b8bbbc7d30a574da9cf63e29bbbed9e_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download