Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 03:17
Behavioral task
behavioral1
Sample
65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe
-
Size
670KB
-
MD5
65ecd6610e080a4aa68692ef4f8c6f06
-
SHA1
a8bbd09e68fcec52fb092b373af6781dd9541dad
-
SHA256
b1d1afa5cd5a22360596443a4686df211c1ff95fe1157f10f15b40e009bcd59f
-
SHA512
e7c7875280d69c8d3c0619d7654d1da1ec3eb36032bb70f936ed5e9bb6a06e100afdb4552d3c0104bb6b5d14508a0bf53deadb6a32e711e0c3bbac91744747ef
-
SSDEEP
12288:j+tQY3u4/30tqXRzueOPrWuZDoZH88fgKxNOMfA33sUKpfcsFmcyouSKhK6udcKs:jGQY+ttqXRNOPrWuOZHHfRXA33OpfPFG
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x00000000005AC000-memory.dmp upx behavioral1/memory/2352-74-0x0000000000400000-0x00000000005AC000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main 65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2352 65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe 2352 65ecd6610e080a4aa68692ef4f8c6f06_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD50afadd4ea31c5e1fd251ac327e5ee0b5
SHA1e60477a0996985c190748a3de7b92c6247cd20b9
SHA256af2031ba4962126c06a6434d9cbb2e8ddb711062dd125b808ed6decffe83703e
SHA51200a40cf63ae1ccc8fd9b89673dfaccde5810db85b5d63fc10d5ec647d75ae29517f13d76acb6d8fa6adb94fb323893607f9199a374e71d3f7c8ef7f8e928ff22
-
Filesize
202KB
MD5a4fdd77e182bd2fabe300a47b5617a35
SHA1e002b335c75b5edefcd251962f61f53a2ab8e0f2
SHA2568b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b
SHA512ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085
-
Filesize
89KB
MD5219073097031d9c1a95a1291d66f3a10
SHA12b7996b01d90b7f424f2a2e6063947461db4b2b2
SHA256232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef
SHA5129ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5