797f97e162a10604a233f2a1b5df5722976d0529e1b131bb5fed035f5590601d

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
Size

150KB
MD5

d487deedd558b961549b3b0ecac2bad7
SHA1

4cb7ef8e40a3a293c538daea38bf73ceda929ead
SHA256

797f97e162a10604a233f2a1b5df5722976d0529e1b131bb5fed035f5590601d
SHA512

8a75e682814948aba43a37923f1c3259c27fe91c3b57d0b8c841cdec4823f71b002e85429319370c933c69336cb517fb05f3e392d0f62117957a0849658dce10
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08Moe9TCmza:aM7jJlRexYTHYZM9TI

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\DivX pro key generator.exe	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\babe celebrating new years naked and spreading cunt.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sexy hot teens gettin busy in shower.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\japanes girl getting it from behind.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\schoolgirl deep sucking some cock.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\two dudes comparing dick sizes.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\sexy little blonde teasing.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\old fucker punishing teeny.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\ebony spreading her pink wet pussy.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\lonely teen thinking of cock while fingering it.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\hotmailhacker.exe	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\honies letting dudes flush mouths full of hot cum.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\two studs fucking the hell out of a slut from behind.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\asian slut with puffy exotic lips.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\some twink ass rippers.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\password stealer.exe	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\horny asian warming her finger in her gash.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\busty ebony girl showing shaved pus.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\ass ripping interracial fuckin.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\AIM Flooder.exe	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\little brown cup-cake with plump boobs and sweet beaver.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\fun slut who let dude eat her off in jacuzzi.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\two teen lesbians with dildo having fun.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\cutie nailed up the ass.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\movie of mom who whip hot ass on daughter's big cock lover.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\an older fat mom spreading wide.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\cum hungry slut accepting goop.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\macromd\lezbos in pantyhose swapping tongues.mpg.pif	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d487deedd558b961549b3b0ecac2bad7_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\movie of mom who whip hot ass on daughter's big cock lover.mpg.pif

Filesize
86KB

MD5
eb6ec5efa66b4ad5ba157b8a9c5a215b

SHA1
f775f9c32f37997819c672c425526c419338fdea

SHA256
7172f1fc14f4ddbfe0a96f1a3a6d3671970403f9979645410e7cfff127b02034

SHA512
7115cdbfcaf781970993dec0648e33662a3e8d10b9c885dcc63d940140be054e4fd36e7d7cb907129b4460150a5a1cce93979a25c29c99b8be66a366203f8ca6

Download Submit
memory/2824-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads