Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 11:55
General
-
Target
349cbff609809a79fc064f965cf7b409_JaffaCakes118.exe
-
Size
258KB
-
MD5
349cbff609809a79fc064f965cf7b409
-
SHA1
e1855b06cb24557a49ad317161151694298a6a8e
-
SHA256
26b4d3499885e6f00e0fb8cc3dbcd0c2f8d6a9e2d359a26c64ffe1fa01f204da
-
SHA512
c243ae2dcc3efc412cd77a3b9966f2d98bbe1e1b6ea7fb4f12a9b354c594e29363aef7680cfc61e9333ad3dc3b5c2948c45514464ff0884beb30bd4353b9fbfd
-
SSDEEP
6144:G6ZDcGRr4nntkQ65GYVyymXBpKKRAzkMgeKfzJMC/uuP:GODcM4nt25GcyRqK2z6eKyC2s
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\349cbff609809a79fc064f965cf7b409_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\349cbff609809a79fc064f965cf7b409_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
172KB
-
Filesize
4KB