857f45e864119e2c445430d239984f8e3a715e295eaaeca658c894760c461601

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Size

543KB
MD5

3f2b8692e264d005e8190ed58698593f
SHA1

0a1fc4d6a6c17070098ca3512e9842060ea22362
SHA256

857f45e864119e2c445430d239984f8e3a715e295eaaeca658c894760c461601
SHA512

b9e67279fa0194fd820e5a9b3c5f8527514439a1ce9a3fbece5a02928bf6dc423fa9a615baa0ce2923d1760181e95df523e9da381c61d7324a5ef83633f8d65d
SSDEEP

6144:GdhOfjZXluQA/qNgSr5oK4c276V6QaNmA:eYjTVxNgSFD+XNm

Score

1^/10

Malware Config

Signatures

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\ProgID\ = "PhoneDialer.Document"	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dialer\ = "dialer.chm"	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\InprocHandler32	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\InprocHandler32\ = "ole32.dll"	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3F2B86~1.EXE"	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dialer	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document\ = "Документ телефона"	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\ = "Документ телефона"	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document\CLSID	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PhoneDialer.Document\CLSID\ = "{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}"	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\ProgID	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D7A956-3C0B-11D1-B4F9-00C04FC98AD3}\LocalServer32	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1204	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
1204	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1204	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
1204	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1204	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
1204	3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f2b8692e264d005e8190ed58698593f_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-0-0x0000000001000000-0x000000000108A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads