592025818396b152fac7d1f65bc2aaff353930e908026b79f04df8ca802286a6

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c001363132aed5c8a5501ffe2a30219f_JaffaCakes118.exe
Size

3KB
MD5

c001363132aed5c8a5501ffe2a30219f
SHA1

7e4283f4adcee911e53f2fa1bc00df83db0fa2b3
SHA256

592025818396b152fac7d1f65bc2aaff353930e908026b79f04df8ca802286a6
SHA512

d8f03fb58bf186a7eeb585894faef69de4633d1ead8c063e7610aa02ae0c46e8aa9507b9ce3fe9cfeb990e75fd818ccc38637e6778564aed3523d6be9d677d8c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.pornograb.com"	c001363132aed5c8a5501ffe2a30219f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c001363132aed5c8a5501ffe2a30219f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c001363132aed5c8a5501ffe2a30219f_JaffaCakes118.exe"
1⤵
- Modifies Internet Explorer start page
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download