2ed333ab989f64a3dc1c516c873100030f04ddef751c24a945cccd530dd3cf82

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
Size

1.5MB
MD5

2ea27525f1730a80d740f20df6ab7f64
SHA1

0d97e5b65b70f2387d56759ec00c757922fc1db0
SHA256

2ed333ab989f64a3dc1c516c873100030f04ddef751c24a945cccd530dd3cf82
SHA512

c3a20001117fea214fb3d3d87e0605f00ef79e63b14d66bffae7f7794778e786e68ec9150e899c56be5672b6d8561cef38838546465e6ce75ae2f87d3e28bdf9
SSDEEP

49152:bXiGtYmUYIqgdZEAeQ1rUwkrEMiyEWFkru:bX7tYmlgdZExwkrgyEB

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
File created	C:\Windows\system32\drivers\etc\hosts	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2264	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
2264	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
2264	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
2264	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2264	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
2264	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
2264	2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ea27525f1730a80d740f20df6ab7f64_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-0-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2264-1-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2264-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2264-23-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2264-24-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download