2f1b172614ef31808c291633c38729984167b009c925d4ea408ab6259361e62e

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe
Size

6.4MB
MD5

60949a26c715769f0fa9f14f5e970441
SHA1

d3415dc35c9dfd477545f97f380a9ede94392216
SHA256

2f1b172614ef31808c291633c38729984167b009c925d4ea408ab6259361e62e
SHA512

d17b919a4cf3aac7787bf12d3b865ceb5166eaff1cc84f85b49806851a559c75c886d7886327aee9a4f92a0c7e9aa509f151de2420110b7179bb27ffc6c7f3cd
SSDEEP

98304:Jzm3nDTHfoyYfESjvf2JjvIjH60bEEEEEEEEEE2EEwEEEEEEEEEEEEEEEvEEEEEK:JaDTgyYMSjvf2JbGeNmpJil

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avg = "C:\\Arquivos de programas\\avg.exe"	60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\System32\\svchosts.exe"	60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchosts.exe	60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Computador - VOCYMMGW.txt	60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3340	60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60949a26c715769f0fa9f14f5e970441_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3340-0-0x0000000000400000-0x0000000000A61000-memory.dmp

Filesize
6.4MB

Download
memory/3340-1-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/3340-4-0x0000000000400000-0x0000000000A61000-memory.dmp

Filesize
6.4MB

Download
memory/3340-6-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads