41ff8c08e0a2e7a051724bc0bfd13b9d9df19fb50f4bf485523c2cc88837ac81

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe
Size

320KB
MD5

4d52810a0390ff496f0feb04c7ec1385
SHA1

0708d998fea7ce92dfd99b9d97b753d4b6c6f9f7
SHA256

41ff8c08e0a2e7a051724bc0bfd13b9d9df19fb50f4bf485523c2cc88837ac81
SHA512

68dee08ad0c3bf655e90dcb29188b88e42a34241d8395664443ca5c3cfb842ccb07c2a8dfd2e126cdf3dba3a893bf31358d2a69b6f4fdbe00cf1488324ee4c77
SSDEEP

6144:26lXsWG6puLQsLOLZDdiSVjmC6SEIg4M:26dsc8L3LOLdfiI4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe

pid process

1660 4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe

pid process

1660 4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe

pid	process
1660	4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe

pid	process
1660	4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d52810a0390ff496f0feb04c7ec1385_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1660

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetBot\getbot.exe
Filesize
320KB

MD5
4d52810a0390ff496f0feb04c7ec1385

SHA1
0708d998fea7ce92dfd99b9d97b753d4b6c6f9f7

SHA256
41ff8c08e0a2e7a051724bc0bfd13b9d9df19fb50f4bf485523c2cc88837ac81

SHA512
68dee08ad0c3bf655e90dcb29188b88e42a34241d8395664443ca5c3cfb842ccb07c2a8dfd2e126cdf3dba3a893bf31358d2a69b6f4fdbe00cf1488324ee4c77

Download Submit