895dbf1b6a44750de720fd5f11c0c22fb9b22069572987744c3e82d3e81985fd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Size

608KB
MD5

65327269f6b981edebe75fcf474bbc17
SHA1

c5e74d593c250a7d1f61206e2948bb17f280f22b
SHA256

895dbf1b6a44750de720fd5f11c0c22fb9b22069572987744c3e82d3e81985fd
SHA512

1fe928c785f2fcd35b2c576054094bf84f568d3da0cee7b63b4968fe81c1c13d8dac65ab9abbcbd94c878a8b2aa258d381aeec088f1eab09796b5b4a76ff9ebe
SSDEEP

6144:yAIE/XZsMmPF0wooxrYv4jnCKYIKUaVXhjz4tGSYrJhcnJ2bUUuAz9GuUYp0514:yAID3xu0nCKYjpFr0gbTuAsudpO

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Command = "ÌÔ±¦ÈÈÂôÉÌ³Ç"	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag\Param1 = "http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_13711484_0_0"	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\ = "ÌÔ±¦ÈÈÂôÉÌ³Ç"	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\Instance	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}\InfoTip = "ÌÔ±¦Íø - ÌÔ£¡ÎÒÏ²»¶"	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
412	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
412	65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65327269f6b981edebe75fcf474bbc17_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:412

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads