11ef19fffa9d118f7c893a8371614ea498229204c30d33c76022bd7fecb2fbd2

Resubmissions

22-12-2024 05:19

22-12-2024 05:18

max time kernel
31s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-12-2024 05:19

Target

JaffaCakes118_11ef19fffa9d118f7c893a8371614ea498229204c30d33c76022bd7fecb2fbd2
Size

344KB
MD5

4b1fb1a9af73ec2d2e5f23e0e5665e28
SHA1

bb3cd987e0454338600b468e3da12051279f93bf
SHA256

11ef19fffa9d118f7c893a8371614ea498229204c30d33c76022bd7fecb2fbd2
SHA512

974c1b3503399b6be7b355636781e81acf2a52f70320ca72983b00789909ba9f595c5ac5ab9053e078b4bdbe063761d430c0d70178088d285cc0d3d270e8de3b
SSDEEP

6144:yBA0i2uim7rAPtf9w8zSRWBt9JPpr+hT5WzYYRh6pIv7u1:yG0iwj9w8zS4BPJPpr+ZYf0

Score

1^/10

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2912	MiniSearchHost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11ef19fffa9d118f7c893a8371614ea498229204c30d33c76022bd7fecb2fbd2
1⤵
PID:5468

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3780

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\df87b88b-400f-4903-a0bb-a694f4a5c582.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
fbbd10b5151e4365bceb3190d826c524

SHA1
45a77c1d88151d54383047d84019bc9e84cfa0c8

SHA256
4400d61bcd5543a3123ae53baff8863336555d96350ec33ce9a3f8242917cbb3

SHA512
32404e11daf2116efd194a65a96c24d83c8b0f1eed80ae63d6077d26e8b51f636db993e98474257fb2aa262d87b6ce6219fdf8f2162b4fd179a3e95c9dbee7f9

Download Submit