2e1e4afa9fd5b51ce02b985b71d2b6f17dde5c449f0ab3d043ce7af74e6d9b6d

Analysis

max time kernel
113s
max time network
117s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

851bd9a9f8028e40b65a87bd66b2f4bc_JaffaCakes118.exe
Size

214KB
MD5

851bd9a9f8028e40b65a87bd66b2f4bc
SHA1

6cbaa74c9edc0761460cf801ec050497d1892f67
SHA256

2e1e4afa9fd5b51ce02b985b71d2b6f17dde5c449f0ab3d043ce7af74e6d9b6d
SHA512

f6ddd6787f4579899820ba90db6863ee698be3bf02f10b698662ad7624cdfd4af6611f9f769ce689ed28118b03d14696406a76e030783b319909590dc6ba7c1d
SSDEEP

6144:XBJMcV7MtMQCfnFOzsv/+ZD7mASoWIRlDi:XBJMYItMQCvFos7AXWI/u

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\393b30272636307a312c31 = "C:\\Users\\Admin\\srbd.exe"	851bd9a9f8028e40b65a87bd66b2f4bc_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1548	851bd9a9f8028e40b65a87bd66b2f4bc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\851bd9a9f8028e40b65a87bd66b2f4bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\851bd9a9f8028e40b65a87bd66b2f4bc_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1548-10-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1548-11-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads