15a7f112f1f666e3f35b3691d4f56b1a0d5fb81a57e47dd654c04bb52df7095c

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe
Size

155KB
MD5

5a005e39c170eb2aba2ea8b5a7146254
SHA1

252ac52a18b93d2334b0c3c0ed6e9a39405bddfa
SHA256

15a7f112f1f666e3f35b3691d4f56b1a0d5fb81a57e47dd654c04bb52df7095c
SHA512

5e3ce00d10bc157963d28a9591dc7ccd1c9cb9dd5e90c6fa21833851ced0887520ea3994fa7d5ca74364521e8578afb02e9a5cc61271a32a8bf4706387c6ffb4
SSDEEP

3072:6oqflT9QbRsYO+s6uHxJOop4TvwKtg+8E8:yflTxpH2wKS+J8

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
3164	5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe
3164	5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a005e39c170eb2aba2ea8b5a7146254_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aiw240631921.ico

Filesize
326B

MD5
3c4d084719ab4dcdd1bd11042e53efc4

SHA1
fd8c8a5c4c49cd4ecd6acd6327860e771bac0ab6

SHA256
3572a6302c3d316e713d4ac42fa66d0c0e3b91434654793b9d772fef76599d4c

SHA512
a8e463131f6b0e198b6aea80b24f3362bdb2a4d9d5350d80a7d7b6278eda716488b493895a6c5dfe4bcc201a8c4c18c0499eb492e53e25dcd78980d156b693e8

Download Submit
memory/3164-15-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download