7a10b5047eba2707fe6f0b674bd60258982bffe365ee937144249e2f99b7700c

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Size

71KB
MD5

4570126cd2f186d1185bfc4e1f94d55d
SHA1

2a43503721171ce479cd10bffe42b502e4bb75e6
SHA256

7a10b5047eba2707fe6f0b674bd60258982bffe365ee937144249e2f99b7700c
SHA512

ba0df76e882fe347f3a6bf150b2ffdd8b152bdbac233d6010a69ebb6e25ba782949a8874668286e120e8b5e91761a89d9ff01446ba75b73572d4760a2d0e6cb7
SSDEEP

1536:4HGhXk9WJkZ5XKZM9VAOJLXSx7kWHe6E99999999LoPxfwrGi9:SX9Z5f9VFL9h99999999Q4rGi9

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\wizcomp = "C:\\ProgramData\\wizcomp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fmthelp = "C:\\Users\\Admin\\AppData\\Roaming\\fmthelp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\fmthelp = "C:\\Users\\Admin\\AppData\\Roaming\\fmthelp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wizcomp = "C:\\ProgramData\\wizcomp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2856	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
2856	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2856	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2856-1-0x0000000000250000-0x0000000000265000-memory.dmp

Filesize
84KB

Download
memory/2856-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2856-7-0x0000000000250000-0x0000000000265000-memory.dmp

Filesize
84KB

Download
memory/2856-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads