Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 15:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42539fb58ef2673370f353d92ded0487_JaffaCakes118.exe
Resource
win7-20240705-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
42539fb58ef2673370f353d92ded0487_JaffaCakes118.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
42539fb58ef2673370f353d92ded0487_JaffaCakes118.exe
-
Size
2KB
-
MD5
42539fb58ef2673370f353d92ded0487
-
SHA1
96721f0e0697d7aff1392e36c3726cce33cc5bed
-
SHA256
9b50cddd32a5b2033510a286245190e0336fd3960b26cb64c6873b357f86eb3f
-
SHA512
da8801db78c834690a9acda6d052111dc784c764cda607c274ca82538934ae306b9f09b1cd3b0b98399f27e3332cfb8360ce8935924401bd322829df8eb41cd6
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings 42539fb58ef2673370f353d92ded0487_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42539fb58ef2673370f353d92ded0487_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42539fb58ef2673370f353d92ded0487_JaffaCakes118.exe"1⤵
- Modifies registry class
PID:4844
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4200