8ecdfd8aadd011e152e0bb4c67b92c4fc42e18a94780ab4354fbe1944c7a403b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
Size

1.7MB
MD5

5d9575f3800ee54ddee7ab4979321b01
SHA1

90b1cbda1b23c59779587fc3c3e7b042e71c5505
SHA256

8ecdfd8aadd011e152e0bb4c67b92c4fc42e18a94780ab4354fbe1944c7a403b
SHA512

21a3cd9667384effb914dfcefe412e0a61d240320240267513978caabb95178afa195a1fcebbdd4b980fee8f3960dbfc296fe368647c379b7488ddf193a5e109
SSDEEP

768:tks+cAXJpB2TgpZnjJHk/OxJ+oFEZEM/4H:tjrAX5NjJHJ+oFE2M/4H

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VMIntel386 = "C:\\Windows\\Intelx386\\VMIntel386.exe 256mb 32bit"	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Intelx386\Winamp 5.0 (full version).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\3D Studio R8 (It's Work!!).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Pack 50 Juegos PS2.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Puta come mierda.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Update Photoshop 8.0 to Photoshop 9.5 (It´s Work!).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\WinRar 4 (with crack).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Silent Hill.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Dont Download.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Winamp 3 (full version).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Update Photoshop 7.0 to Photoshop 9.16 (It´s Work!).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\RealOne Player (Full version).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\WinZip 9.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\humor.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\WinAce 3.85 (with Serial).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Mazinkaiser pack fondos de escritorio.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\FlashGet Max acceleration (Experimental).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Download Accelerator Plus (DAP) (full version with serial).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\ContaWin 2000 (full version).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\WinRar v6.11 (with crack).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\MSN messenger 6.3.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\RM2GBA.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\GameCube Emulator.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\a pelo.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\DivX 7.2 freeware.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Mazinkaiser comics pack.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Capitulos ineditos de DragonBall Z jamas emitidos.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Pack 25 Juegos GameCube.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Solo para Maricas.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Terminator 3 Wallpapers.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Pack Photoshop CS 8 plugins.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\3D Movie Maker.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Visual C.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Visual Studio (full).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Follada brutal coño roto.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Lolita Pack 20 Pics.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\No lo Descargues.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Dont Touch.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\WinAmp skings and plugins.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Resident Evil for GameCube.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Visual Basic 6.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\mugen (full).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Sexo con una menor.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Shinchan screen saver.scr	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\VMIntel386.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\VirtualDub 2.1.4.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Hacha Profesional Edition.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Pack Tonos y Logos para Nokia.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\GBAEmu.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\German extreme violation.mpg.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Hentai.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\PSEmu.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Fuck my fat ass.avi.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Chenoa en cueros.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Juegos JAVA para NOKIA.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Nero 7.5.1.0 (cracked!).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Pedofilia pack 37 pics.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\BsPlayer v3.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\WAV2MP3.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Matrix Wallpapers.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Hentai Evangelion Poker.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Pack sex very hot nude young girl porn erotic private pussy rape clitoris suck chicas fotos culos tetas coños mamadas corridas sister hermana amigas friends lesbianas mujeres desnudas putas guarras hentai.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Winamp 3.5 (full version).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Simpsons pack guiones (Temporada 2004).exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
File created	C:\Windows\Intelx386\Hentai Shizuka clit.exe	5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d9575f3800ee54ddee7ab4979321b01_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Intelx386\Update Photoshop 8.0 to Photoshop 9.5 (It´s Work!).exe

Filesize
3.5MB

MD5
49147a1fce6c54d0f7687da4333fd8a1

SHA1
a6024f3c9a23b338d49c0922d4cc614b340daa58

SHA256
6ae9c37ff4ecaa16e941843d5b02486a51708d3259529306a0522c127818ea09

SHA512
bee9379c72128b93f27f827d34abd66d1f324334836480ea4d38bc57b2513e39e50d7835d8a3d18c3f1ac7da985be8f45341f12ab6cb3fc9e0140eddd489fdc8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads