2f4297c8de03ad80b7c517339d34c34bb5d597b5c01e525b54faa50607733536

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe
Size

421KB
MD5

4a57c2f3c54980c48ec1d3f6f3fef9ad
SHA1

76a2bebf7c3325e87101a5d8aa398b7089a8c1aa
SHA256

2f4297c8de03ad80b7c517339d34c34bb5d597b5c01e525b54faa50607733536
SHA512

d2059994e865796e5c46269278fa8dced44b51dde73a5d5932bd0877850769032832e0dfda24c217b37e37b9290f01a92ab65876789b92143a69bc764b81d342
SSDEEP

6144:VYTTJl0BlFnA95P7w33TnYYTHy9XiUCH4J8CraJH/V7CtYfXn8WPXXD7aHSUl:V2TJlKRykTYYwm4J9rmZCtYPRPjuya

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1040	4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe
1040	4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\td0\Users\USER\Desktop\document software\kingsize\index.html

Filesize
3KB

MD5
df2cc487c575a0e3ce5d0c97c52cc50b

SHA1
691c88c30011f450a2f60ecba745232ff0276068

SHA256
08c5bc2e9748748655aaa34bcbd4ba005700ab28e7037551e47db3b9c18cfc18

SHA512
fa40385501609da5e38f79715604766bf42359e80b564d24d9debfbfa79ada351e4c4b63db9f8d87896717e8c432a19bed999ccb882626e005baa5512d090ac2

Download Submit
memory/1040-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1040-33-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1040-35-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download