1cc99efabf3bf5e380f7eb38953c90b9d3234775bfa2cc707cd483011209dfd5

Analysis

max time kernel
141s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61023992049b0560f449bc05885f3ef3_JaffaCakes118.exe
Size

92KB
MD5

61023992049b0560f449bc05885f3ef3
SHA1

2a0f12f2e9eb5048d56f2e7e75a9d4d7f6edffe3
SHA256

1cc99efabf3bf5e380f7eb38953c90b9d3234775bfa2cc707cd483011209dfd5
SHA512

df3a0bb0fd433c4b6fd78f32ef8fcade7377a0c5551e16d7356547bfbfa5698a3bafcabd2e7170c7babcd573b73652535ab3ced479a8323da1b493f7d9c5d930
SSDEEP

1536:B+J8hsY8hEbOoA1PzZN2ZhrxA6oeHxQ67qsebyIs7CLgsd4yfTV43xpO3qV88NFM:B+J8hkhECb1LZ4VRoe6bECaQVOO3qV8v

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	61023992049b0560f449bc05885f3ef3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\61023992049b0560f449bc05885f3ef3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61023992049b0560f449bc05885f3ef3_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
1KB

MD5
5903a139410cfed777dd7ea541c5f891

SHA1
9e6713c734ce8da0eb3262324428c2101ad8719b

SHA256
079c7dbf3544f2e1b5555701319100bc77453464bfbd5cb1ecaf1eb425b6f10b

SHA512
ba9d1cb9c2ab6edbebf83ea9e19c06f27564fab835c0c0fab57a96bf66c086a14b5fa5f4206a544513faac98017cb211a61fc62e5f4205941ac3d38a574737ee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
792B

MD5
42cb8b89d50cbfce98b8c7f8605538ca

SHA1
e5f27a7324d6b47dda2e84e5580d306eb27e038c

SHA256
8e76905fb8678da343198a7a3570c514c480dd22202181d6f2c4ca1a370d95ac

SHA512
0317a216721b3d403ce11a41afcefa87aacc210dc7757ba35fcef71b7c9632369900e7609a0112a8bb9f6f8554e296718b2df9f94a49df2d21fca81ead1c6f0b

Download Submit
memory/1388-0-0x0000000000530000-0x0000000000546000-memory.dmp

Filesize
88KB

Download
memory/1388-2-0x0000000000BE0000-0x0000000000C2F000-memory.dmp

Filesize
316KB

Download
memory/1388-20-0x0000000000BE0000-0x0000000000C35000-memory.dmp

Filesize
340KB

Download
memory/1388-22-0x0000000000BE0000-0x0000000000C2F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads