Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe
Resource
win7-20240704-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe
-
Size
437KB
-
MD5
33e0d10ed78082113c4b0471e8eda70b
-
SHA1
04bc9f554f183596a8086d755c618b84fc83b5cd
-
SHA256
438a98050f85ae460f8828dbb79367ca6e05acaf42ee5ef7ec3624339b1e042e
-
SHA512
bac9a2f2fa9745cae96a5b07ab7be43248157cf3346cf80c749bdc99b78f0271a3f9df852275c44f8a49dd2fe7825249bb4a8c8b862c757d4713077fc49a3923
-
SSDEEP
6144:r9yZDxwrAZjHx5585ptrxjBIdhQM5OcZGiysMOYf2ij0sh8CIpz7IG:hrAZzx/QrUrQKOcpcwsaqG
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe" 33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe" 33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\6f641c9f08.imb 33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4696 33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe 4696 33e0d10ed78082113c4b0471e8eda70b_JaffaCakes118.exe