a8fb4651e71a3e720f8f801f3f411a8813da315f701bd9927346048c7b0203ad

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
Size

149KB
MD5

d271c09e09f8c9081482a0467a8aa243
SHA1

83d28e024a4a1833bf64caaacad4807847e831d2
SHA256

a8fb4651e71a3e720f8f801f3f411a8813da315f701bd9927346048c7b0203ad
SHA512

148277403f35433062bd47a19f40eebd8cf7a559426d2d37422dc0877225c195872219b1094f833bb3c38ecd066e81f7c8125a93045e50614dbb513c2648eeab
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08Moehs8teq5SIj:aM7jJlRexYTHYZM6VY

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\little brown cup-cake with plump boobs and sweet beaver.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\yummy lesbos licking.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sunbathing beauties tanning tender pussy lips.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\ass ripping interracial fuckin.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\two studs fucking the hell out of a slut from behind.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\horny housewife looking for some action.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\couple babes getting off with well hung dude.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\older blonde showing she has the goods.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\showing some hot girls share cock.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\babes getting facials and riding cocks.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\divx pro.exe	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\polish naturals with nice round titties.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\babes with oversized hooters spreading.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\dude getting off in lover's mouth at party.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\two interracial lesbians licking each other.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\two teenie boppers learning to eat pussy.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\yummy lesbos licking wet pussy holes.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\girls with cock in hand and mouths fill with cum .mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sweet ass blonde teen with dripping wet pussy.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\bigger chunky girl with huge tits posing in the buff.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\patricia arquette showing her tits.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\pamela anderson nude.exe	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\nasty chick in hardcore fucking.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hot butt sex ..unbeliveable.mpg.pif	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d271c09e09f8c9081482a0467a8aa243_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4256,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe

Filesize
77KB

MD5
d9a6978fb2aa250fe5fad2a035bd9940

SHA1
9a284155686b3f312b7b9ebd4ff78118802a3712

SHA256
7fd6099647133adb86372af886568121a83cde5b784e594ad8f261725ceb3b34

SHA512
eb5974defd6532cc3f7c78332d56d2d059c38d087e25ac48e01eb76527391e07dd6611cab4020a61e9542c5e05400cc683d28e44b47e5a126ebd15fb6ce288bc

Download Submit
memory/2272-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads