5a291b33da4d536a5ba68124086f41c24e100af5be308af716d614fddae02169

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaceaf1277a66d394d672b8ff0d650f0_JaffaCakes118.exe
Size

272KB
MD5

eaceaf1277a66d394d672b8ff0d650f0
SHA1

1c88050f67814a525456bb3447018739f9887f8a
SHA256

5a291b33da4d536a5ba68124086f41c24e100af5be308af716d614fddae02169
SHA512

88ddcc70a8604ea3d39df034cb1855ccdeaa7fdebc7a36cca5e37e14a654067785faff0d597d71bfbc4c390259e36a1ce4221c42efa46ada852f15d84d52025d
SSDEEP

6144:NVUfpsZaCfrTsNwwYwX+oGi8WQkabsnMuIAFnsk:NVUaZlzTlwYwX+zi0qNIP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	eaceaf1277a66d394d672b8ff0d650f0_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5088	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\eaceaf1277a66d394d672b8ff0d650f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eaceaf1277a66d394d672b8ff0d650f0_JaffaCakes118.exe"
1⤵
- Modifies registry class
PID:4468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4468-0-0x00007FF89FC25000-0x00007FF89FC26000-memory.dmp

Filesize
4KB

Download
memory/4468-1-0x00007FF89F970000-0x00007FF8A0311000-memory.dmp

Filesize
9.6MB

Download
memory/4468-2-0x000000001C380000-0x000000001C84E000-memory.dmp

Filesize
4.8MB

Download
memory/4468-3-0x000000001C900000-0x000000001C9A6000-memory.dmp

Filesize
664KB

Download
memory/4468-5-0x00007FF89F970000-0x00007FF8A0311000-memory.dmp

Filesize
9.6MB

Download
memory/4468-8-0x00007FF89F970000-0x00007FF8A0311000-memory.dmp

Filesize
9.6MB

Download