1b3d6a89ed2f1e7f7d49d73bafc4a0cb16e7dd311c9bd1a4f3c03fe4ef0368fd

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b444e25a131f5fb96f6656a74a8fc99_JaffaCakes118.exe
Size

1.8MB
MD5

5b444e25a131f5fb96f6656a74a8fc99
SHA1

7fa201de725ee14b6bc99e955f925692f5a5c826
SHA256

1b3d6a89ed2f1e7f7d49d73bafc4a0cb16e7dd311c9bd1a4f3c03fe4ef0368fd
SHA512

7b183f0fd07ba40aec2264bcea3f32f14b732dd8276dcd2cb5cb710b3e5e493d3cca3225510ca1c634c0cb65b5ddb4c20bcd789f06d529951b1198cd3ae60dd5
SSDEEP

49152:uFP8YxJAqpkmixLt4zghiKjjTha3yxaZIf9:OxJAqpoxRaeisThLd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\software = "C:\\Windows\\system32\\software.exe"	5b444e25a131f5fb96f6656a74a8fc99_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\software.exe	5b444e25a131f5fb96f6656a74a8fc99_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\software.exe	5b444e25a131f5fb96f6656a74a8fc99_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4908	5b444e25a131f5fb96f6656a74a8fc99_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5b444e25a131f5fb96f6656a74a8fc99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b444e25a131f5fb96f6656a74a8fc99_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4908-1-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-2-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/4908-3-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/4908-4-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-5-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-6-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-7-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/4908-8-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/4908-9-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-10-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-11-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-12-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-13-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-14-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-15-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-16-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-17-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-18-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-19-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download
memory/4908-20-0x0000000000400000-0x0000000002A86000-memory.dmp

Filesize
38.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads