35035dec83575920127ffcd3792aad04d520218a9eef9e7312df791f5c990000

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c123690838c53244071fccd072bb8788_JaffaCakes118.exe
Size

147KB
MD5

c123690838c53244071fccd072bb8788
SHA1

0230c3e1268d6a35fb2da86b0f1a907554537011
SHA256

35035dec83575920127ffcd3792aad04d520218a9eef9e7312df791f5c990000
SHA512

d7838a0875f2b3e53099a71d7b86d39f74b648728286b61b9f059d4f4ec00bd4262764018c9d69267574f0b9ee24d08806f1ce6221a705b2f44901460f9fa588
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08MoeEUyCk:aM7jJlRexYTHYZM7zk

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	c123690838c53244071fccd072bb8788_JaffaCakes118.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\latina shemale playing with her cock.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hot blonde teen sucking old dick.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\honie displaying raw pink ass.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\amateur getting off in the mirror.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\babe celebrating new years naked and spreading cunt.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\shaggy pussy girl posing.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\blonde busty plumper in the nude.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Kama Sutra Tetris.exe	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\babes with an assortment of delicious big juggs.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\lusty teen peeing in backyard.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\pretty babe sucking cock on bed.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hot anal sex for the first time ever.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\supermodel nina brosh .mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\dude getting burned out trying to fuck 2 hot babes.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sexy hot teens gettin busy in shower.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\divx pro.exe	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\the skirt of a babe on the stairs.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\busty babe in lingerie.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\illegal preteen porn anal fisting.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hardcored blonde mature.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\crazy old man playing young teen.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\nasty brunette getting hard jolting.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sister and brother gettin' freaky .mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\older blonde showing she has the goods.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\weird fetish drawings as chicks do it all.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\this really wild insane groupsex.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\celeb's toes being suck by body-guard.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\blonde in jeans undressing and teasing her snatch.mpg.pif	c123690838c53244071fccd072bb8788_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c123690838c53244071fccd072bb8788_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c123690838c53244071fccd072bb8788_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c123690838c53244071fccd072bb8788_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\illegal preteen porn anal fisting.mpg.pif

Filesize
94KB

MD5
fe38590c8de736af17917475ea9f765e

SHA1
0ee9d3bd2aead8c2954bdb8bc148419e892f5cd0

SHA256
00b423dd51269e60ce24d14fa7bd6bf10e3b66fc66800d6de26c456dd5f0ead9

SHA512
86f2091fb13293c22a49335c59538e137780a282952539e810b2167995af226d1e8212c266826bb353004a96e0023699e5e50e2ff1d03f887c50df68c5f58a85

Download Submit
memory/1812-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads