b5f9cf58f2eaf8776d181b4003f41edf15a7c5678405afb9dce1ff57ef5cfa8a

Analysis

max time kernel
136s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

645c0d76b232764359bbc947c0a0456d_JaffaCakes118.exe
Size

44KB
MD5

645c0d76b232764359bbc947c0a0456d
SHA1

a65ab61ac76efb140dbeb4aa888e6b42013ccd34
SHA256

b5f9cf58f2eaf8776d181b4003f41edf15a7c5678405afb9dce1ff57ef5cfa8a
SHA512

61ac9011dbb1e1f5a81799979064dc83b711670c775d9478a58b0ef529e23258fec0676c62e6234ecb7a0faad0ecaf721a3edda3f0cf935842ead1cfd4bc37cb
SSDEEP

768:F8TH3xF5saFNAZtzNmqfZ6hrg6oe8TH3:o3SaFMZhfYhE6o13

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MSOutlookEx = "C:\\WINDOWS\\SYSTEM32\\MSOUTLOOKEX.EXE"	645c0d76b232764359bbc947c0a0456d_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\MSOUTLOOKEX.EXE	645c0d76b232764359bbc947c0a0456d_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\MSOUTLOOKEX.EXE	645c0d76b232764359bbc947c0a0456d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1980	645c0d76b232764359bbc947c0a0456d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\645c0d76b232764359bbc947c0a0456d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\645c0d76b232764359bbc947c0a0456d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads