f2a8064cff73b36e12d678811e3101b4c4014010198c41f49599d0164bcc8f57

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e859933d37aaa90b808ec1440bb51328_JaffaCakes118.exe
Size

146KB
MD5

e859933d37aaa90b808ec1440bb51328
SHA1

15158f9f12fdb460e08cf9088d29c292f2684057
SHA256

f2a8064cff73b36e12d678811e3101b4c4014010198c41f49599d0164bcc8f57
SHA512

e8c2875c421a729faf354bca63ea8a672e9763fe300f083f7550619305b34beabf38ce7ae997c4b96721064772b4296995195e2ed0987d70e73c188010f65d7a
SSDEEP

3072:Gb719t9l1B6zanoHDwTfGbzwHKs9sfxcUi4zcxzuAKR57W8+Rh9Xi:Gb7Vr1BnGRbQcRi7zM57ORh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2192	ljfxfi.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	ljfxfi.exe
File opened (read-only)	\??\A:	ljfxfi.exe
File opened (read-only)	\??\K:	ljfxfi.exe
File opened (read-only)	\??\L:	ljfxfi.exe
File opened (read-only)	\??\M:	ljfxfi.exe
File opened (read-only)	\??\O:	ljfxfi.exe
File opened (read-only)	\??\R:	ljfxfi.exe
File opened (read-only)	\??\S:	ljfxfi.exe
File opened (read-only)	\??\Y:	ljfxfi.exe
File opened (read-only)	\??\H:	ljfxfi.exe
File opened (read-only)	\??\B:	ljfxfi.exe
File opened (read-only)	\??\E:	ljfxfi.exe
File opened (read-only)	\??\G:	ljfxfi.exe
File opened (read-only)	\??\I:	ljfxfi.exe
File opened (read-only)	\??\W:	ljfxfi.exe
File opened (read-only)	\??\X:	ljfxfi.exe
File opened (read-only)	\??\Z:	ljfxfi.exe
File opened (read-only)	\??\J:	ljfxfi.exe
File opened (read-only)	\??\N:	ljfxfi.exe
File opened (read-only)	\??\P:	ljfxfi.exe
File opened (read-only)	\??\Q:	ljfxfi.exe
File opened (read-only)	\??\T:	ljfxfi.exe
File opened (read-only)	\??\V:	ljfxfi.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\0818EE4F = "3922201920"	ljfxfi.exe

C:\Users\Admin\AppData\Local\Temp\e859933d37aaa90b808ec1440bb51328_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e859933d37aaa90b808ec1440bb51328_JaffaCakes118.exe"
1⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\ljfxfi.exe
C:\Users\Admin\AppData\Local\Temp\ljfxfi.exe -svc
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies Internet Explorer settings
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ljfxfi.exe

Filesize
146KB

MD5
e859933d37aaa90b808ec1440bb51328

SHA1
15158f9f12fdb460e08cf9088d29c292f2684057

SHA256
f2a8064cff73b36e12d678811e3101b4c4014010198c41f49599d0164bcc8f57

SHA512
e8c2875c421a729faf354bca63ea8a672e9763fe300f083f7550619305b34beabf38ce7ae997c4b96721064772b4296995195e2ed0987d70e73c188010f65d7a

Download Submit
memory/2100-33-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2100-0-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/2100-11-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2100-12-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2100-1-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2100-34-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2100-2-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2192-30-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2192-26-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2192-29-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2192-27-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2192-28-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2192-25-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2192-35-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2192-37-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download