Analysis
-
max time kernel
141s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 08:37
Static task
static1
Behavioral task
behavioral1
Sample
4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
4906eee1a547f40654a5e810087435ba
-
SHA1
5c7696ed0b9f27b879b7190f9bc8510859fe08e8
-
SHA256
33d5fe35a0d10b6c48f8beb51f456f4fa6fa78b1097bef5fa6eeeb73665e411a
-
SHA512
b41f942c38c24b74d0fad4b7b5b35f8fce8aefb3f0068e57542c37a20bbd02354ed0b2a8abd7709ee6346fd8cfd761974cdbb25a27ff72b885abd3985d5ed510
-
SSDEEP
24576:xhfMcFd9bkf+OumCUSl6WudjwcAsKsdwgjkD8ifdsE154W8OXo+KoWg7hVIq8+8q:zDbkJuv6nccA0w38iaISOXo+tx/vo
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\TypedURLs 4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4720 4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4720 4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe 4720 4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4906eee1a547f40654a5e810087435ba_JaffaCakes118.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4720