Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23/07/2024, 12:41
General
-
Target
67a31ff2ad0e85622ffbde60869336fe_JaffaCakes118.exe
-
Size
3.4MB
-
MD5
67a31ff2ad0e85622ffbde60869336fe
-
SHA1
999ce605f537d27597690f1dfbdd3b478fb7f49f
-
SHA256
62698ee74ddbc349e138f0ca1541e211b8af717421a3575e8d4c562c46aaeba9
-
SHA512
0dc1da533f81897efc0910b01745f045c57f4620fab4fecb389272880002453fa1de3e48e5dd601d38af89d0fd201797bb8f0385a92b7e6e0aa06ae766829118
-
SSDEEP
98304:2Aapj2lFmPzIyFRUULcpZyROB7Ldr7bYXITcJPAf0:uJgmPzd9LcHVx8W0
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67a31ff2ad0e85622ffbde60869336fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\67a31ff2ad0e85622ffbde60869336fe_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB
-
Filesize
19.6MB