Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:44
Behavioral task
behavioral1
Sample
eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
General
-
Target
eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe
-
Size
70KB
-
MD5
eac88f61136d191409e95419efa5fc32
-
SHA1
1c3280f5501ae06b96a2e19bc431491830f428b2
-
SHA256
a9c81df769a26bc734c8c8e94df6a36ce9ae2abc244a827490cb18a09b7c2b3c
-
SHA512
1f3d1f718f44a9896aae1627fb40c092b213c0e0336d4b7e7d4a66d9abc8b59231d8795eb0ec36c619c2e1027ade52d0b08c53385c248b2d1a577c2af7256579
-
SSDEEP
1536:Trt3vNnaCjInzyUSgn5BCXDE71KYuAp4uMN0N4OQzNRwu:TRFnDOBSqBC4JKYuAp42NZQ3
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/828-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/828-2-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Modifies data under HKEY_USERS 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\.current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.Current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\SecurityBand\.current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Key created \REGISTRY\USER\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.Current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\SecurityBand\.current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\BlockedPopup\.current\ eac88f61136d191409e95419efa5fc32_JaffaCakes118.exe