7a10b5047eba2707fe6f0b674bd60258982bffe365ee937144249e2f99b7700c

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Size

71KB
MD5

4570126cd2f186d1185bfc4e1f94d55d
SHA1

2a43503721171ce479cd10bffe42b502e4bb75e6
SHA256

7a10b5047eba2707fe6f0b674bd60258982bffe365ee937144249e2f99b7700c
SHA512

ba0df76e882fe347f3a6bf150b2ffdd8b152bdbac233d6010a69ebb6e25ba782949a8874668286e120e8b5e91761a89d9ff01446ba75b73572d4760a2d0e6cb7
SSDEEP

1536:4HGhXk9WJkZ5XKZM9VAOJLXSx7kWHe6E99999999LoPxfwrGi9:SX9Z5f9VFL9h99999999Q4rGi9

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wizcomp = "C:\\ProgramData\\wizcomp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fmthelp = "C:\\Users\\Admin\\AppData\\Roaming\\fmthelp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fmthelp = "C:\\Users\\Admin\\AppData\\Roaming\\fmthelp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wizcomp = "C:\\ProgramData\\wizcomp.exe"	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3564	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
3564	4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4570126cd2f186d1185bfc4e1f94d55d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3564-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3564-1-0x0000000002170000-0x0000000002185000-memory.dmp

Filesize
84KB

Download
memory/3564-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3564-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3564-8-0x0000000002170000-0x0000000002185000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads