15a7f112f1f666e3f35b3691d4f56b1a0d5fb81a57e47dd654c04bb52df7095c

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe
Size

155KB
MD5

5a005e39c170eb2aba2ea8b5a7146254
SHA1

252ac52a18b93d2334b0c3c0ed6e9a39405bddfa
SHA256

15a7f112f1f666e3f35b3691d4f56b1a0d5fb81a57e47dd654c04bb52df7095c
SHA512

5e3ce00d10bc157963d28a9591dc7ccd1c9cb9dd5e90c6fa21833851ced0887520ea3994fa7d5ca74364521e8578afb02e9a5cc61271a32a8bf4706387c6ffb4
SSDEEP

3072:6oqflT9QbRsYO+s6uHxJOop4TvwKtg+8E8:yflTxpH2wKS+J8

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
2552	5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe
2552	5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-3-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download