Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 22:37

General

  • Target

    3afd1048090fe78f9d8fefd9ad2aab3f_JaffaCakes118.exe

  • Size

    17.2MB

  • MD5

    3afd1048090fe78f9d8fefd9ad2aab3f

  • SHA1

    cfabf0af50619dc7fcb7dac9132419c6e193aa84

  • SHA256

    1cc9dbbd71f35353ea8a98c0380e1b79fbf4149e18d51c66994a83d73345086c

  • SHA512

    cd3b5abca7dd4af57f8d03d8a57592d97f533cac47ae9cab0416b4f68bf5880119657917808b51cb7c343fca8c10b85d453f6eb30145c3ef196e2c1bd650fe8a

  • SSDEEP

    393216:6pe4/pPj0Hy3UljVg87k3Xx8exx5sGemyiIrTk7jH:5s0Hy3UljVD7Y8examZqY

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3afd1048090fe78f9d8fefd9ad2aab3f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3afd1048090fe78f9d8fefd9ad2aab3f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4220
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\TimeBroker

    Filesize

    17.2MB

    MD5

    3afd1048090fe78f9d8fefd9ad2aab3f

    SHA1

    cfabf0af50619dc7fcb7dac9132419c6e193aa84

    SHA256

    1cc9dbbd71f35353ea8a98c0380e1b79fbf4149e18d51c66994a83d73345086c

    SHA512

    cd3b5abca7dd4af57f8d03d8a57592d97f533cac47ae9cab0416b4f68bf5880119657917808b51cb7c343fca8c10b85d453f6eb30145c3ef196e2c1bd650fe8a

  • memory/4220-0-0x00007FFE31533000-0x00007FFE31535000-memory.dmp

    Filesize

    8KB

  • memory/4220-1-0x0000000000B70000-0x0000000001CA2000-memory.dmp

    Filesize

    17.2MB