Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
21/07/2024, 23:29
General
-
Target
61dd70476f3bdc7994388bd1417e0263_JaffaCakes118.exe
-
Size
24KB
-
MD5
61dd70476f3bdc7994388bd1417e0263
-
SHA1
9ed5872a47a773de4ecf679621f648448d233c57
-
SHA256
4fcab72cc56751d28e872ec34354bda1c8b622a26f62a4eef02b21fbcd239a2a
-
SHA512
ca2312dfc8ac02a5fb4dc6b6df09044a8fcc5d1b58bd1274cb9755ccbfdd2ee7f3487b474c0620600efc8d997ef3629b731fb72aeec3fabb7031cb6b92fe84fc
-
SSDEEP
768:JXjYi6qKUWpmIehIBAZqXVM3V88t4RRnXI:BYTUdIehIBAZqM3t
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Control Panel 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61dd70476f3bdc7994388bd1417e0263_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\61dd70476f3bdc7994388bd1417e0263_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292KB
-
Filesize
24KB
-
Filesize
12KB
-
Filesize
292KB
-
Filesize
24KB