dd74b23c4e40d9dc670935f5b6adc9ea6b45a5d4393e7905c659f358f4d2ad0f

Analysis

max time kernel
0s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
Size

515KB
MD5

ebc0e82a2872dd1be27db20471093cc6
SHA1

eb91725bac938dae67017f9f25a54f6e2295e644
SHA256

dd74b23c4e40d9dc670935f5b6adc9ea6b45a5d4393e7905c659f358f4d2ad0f
SHA512

2ded0d9984829042f07881405f64e07f99b67552d8227e5e0711b4ca6d24650dcfa4ff20635c65d9549d2c9cdcef1c96d30f1d93affa569fb0fb7f519d2f8f54
SSDEEP

12288:4Yiqxx3RFeaa+jeyIH4RdcuAV7tK+R+ByjeyIH4RdcuAV7tK+R+B1:T3Kaa+ZIYzDN+ayZIYzDN+a1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1688	belum.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\K:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\O:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\P:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\R:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\A:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\G:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\M:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\N:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\V:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\X:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\E:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\S:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\T:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\U:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\W:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\H:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\I:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\J:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
File opened (read-only)	\??\L:	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebc0e82a2872dd1be27db20471093cc6_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Maps connected drives based on registry
PID:3644

C:\ProgramData\Awmouc\belum.exe
C:\ProgramData\Awmouc\belum.exe
1⤵
- Executes dropped EXE
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Awmouc\belum.exe

Filesize
515KB

MD5
7bde2978ac01be11aad815ffafa2242c

SHA1
235233cb33526b13aa3039929b3b3d0e6689e8e7

SHA256
1cd1dc5b358707eb622888f3071006f42f841242d230882d0a7b48b391f9c3f4

SHA512
7d84b37a27920c2bd4a9e9996eaa3371f24191dc6a9690ba2c2787b8c487a85b40f4b54d0bf7b01981dbe04cfef5868599f958ee6ca5000d1da22684220b41b1

Download Submit
memory/1688-12-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/3644-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads