Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
6779ce241ef42c0d4fa5a0f696d33e92
-
SHA1
4ab56181194100b613c01303c8bd2a500ace7e69
-
SHA256
ef0f82b472aab1edf99b46c71976a7d823d3e9c903e45e0a79f770c57fc61160
-
SHA512
7e70bfa3a4925a6a88192201a2a9258586f7878d9e7802087e18b8659541b77c2e802e3615075ac8c59a1ba45b3376b8243e0d91a52889e8e85ce056304bb9c1
-
SSDEEP
12288:bdPqPFdPZdPrPFdPZdPiPFdPZdPFPFbSDyTFtj6PHdPZdPfPFdPZdPwPFdPZdPNe:UDyTFtjYDyTFtjODyo1tj
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.tmp 6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp 6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe File created C:\Windows\SysWOW64\notpad.exe 6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe File created C:\Windows\SysWOW64\notpad.exe- 6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" 6779ce241ef42c0d4fa5a0f696d33e92_JaffaCakes118.exe