7cfd2e2fbacf97eee397c08aa87cd486c2ba398f8e020746088a0c325b2aed9b

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe
Size

604KB
MD5

66eb2d509e23d00987bdefc1b20bc43e
SHA1

2ec5008b3c7c6574c5f3963f26cb3d9df0182f86
SHA256

7cfd2e2fbacf97eee397c08aa87cd486c2ba398f8e020746088a0c325b2aed9b
SHA512

680b5530c55b351f7d48f07dcab8c14d01637cc801388d0148f9c62d89f258c56f8c5bf0b8b56071bc3d0a3edcce7ad738cf7481a627ce8f28729bd6a9c11d7c
SSDEEP

12288:aenEIZY8BAmVaJ3tmb+8fZY8BAmVaJ3tmb+8:aDIZrOttm9ZrOttm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1512-0-0x0000000000400000-0x00000000004E7000-memory.dmp	upx
behavioral1/memory/1512-16-0x0000000000400000-0x00000000004E7000-memory.dmp	upx
behavioral1/memory/1512-17-0x0000000000400000-0x00000000004E7000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1512	66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe
1512	66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe
1512	66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe
1512	66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe
1512	66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66eb2d509e23d00987bdefc1b20bc43e_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-0-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/1512-16-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/1512-17-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download