071caa9f1446a6a5531d8d488145e3e9a49f58db33946bf8df372baf1e002ce0

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dd9d2115c505f50d75b70ebb4490c4f_JaffaCakes118.exe
Size

7KB
MD5

3dd9d2115c505f50d75b70ebb4490c4f
SHA1

0fdf3ab87ada9429f9b75e0d5b76de2c25090199
SHA256

071caa9f1446a6a5531d8d488145e3e9a49f58db33946bf8df372baf1e002ce0
SHA512

fa3a2e55140ab6018528bd3d261baffa21cda3d232f9358cdb05044212067508ae0028c8b41c05232331dca4e7bf8b763fb157b8028cd26719b74530532f4924
SSDEEP

96:nP6MEpA87IrhXkWXB1vhSiOMgg+KVFZ6UekvRaT9abq5:nCMuz0T1ZZOMggVFI4RaT9abq5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	3dd9d2115c505f50d75b70ebb4490c4f_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4276	OpenWith.exe
1168	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\3dd9d2115c505f50d75b70ebb4490c4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3dd9d2115c505f50d75b70ebb4490c4f_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:3952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-4-0x0000000001010000-0x0000000001019000-memory.dmp

Filesize
36KB

Download