45b21631ad7e47d1ef66bbf6e8a22c08700ac189764aaae92544ed5d14062b7e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 09:03

Target

d191e0266ccdb2dfd60b3597e688c5f3_JaffaCakes118.exe
Size

60KB
MD5

d191e0266ccdb2dfd60b3597e688c5f3
SHA1

a38b743ef6b151ff6e5984a699ecfbe2d349ef31
SHA256

45b21631ad7e47d1ef66bbf6e8a22c08700ac189764aaae92544ed5d14062b7e
SHA512

eefbbee966a36b7624bb7981fb167e04fffa2176f442a9232110fdc7c48f966b8b575746621850a4ff74c10d013fd36704a2393214bc57c9c4745313a0adc4a6
SSDEEP

1536:3yJnDSg1PW3A0pINwIGK7hJqzKjeOyWEMyl:g30A0kw4KzTMyl

Score

8^/10

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ddi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d191e0266ccdb2dfd60b3597e688c5f3_JaffaCakes118.exe"	d191e0266ccdb2dfd60b3597e688c5f3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d191e0266ccdb2dfd60b3597e688c5f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d191e0266ccdb2dfd60b3597e688c5f3_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
PID:2524