13c0825cb3fa8d8e6c910276d6ef01815b4e7d9dbeb31c349cccd73a131d8d49

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a86be472a621720f036e11db96d2789_JaffaCakes118.exe
Size

258KB
MD5

4a86be472a621720f036e11db96d2789
SHA1

615dfef1a2f21a2cce97574cb6e4fd2ee0cbac30
SHA256

13c0825cb3fa8d8e6c910276d6ef01815b4e7d9dbeb31c349cccd73a131d8d49
SHA512

edeafa7046ab98b4b74af6509d8e435f3b7d45d505ea50962f65eaaa457e44c2f6a6a7ce89917117f2a9b76864afa0b7c4c623b7f69f91a217f4f7f4db7b1fe3
SSDEEP

6144:lTtZeVxMcz6swxHXVuEXKnQTHDDEqYYUpaU:lfuMMwxHkEXEkUpaU

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	4a86be472a621720f036e11db96d2789_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	4a86be472a621720f036e11db96d2789_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\4cast.job	4a86be472a621720f036e11db96d2789_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4a86be472a621720f036e11db96d2789_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a86be472a621720f036e11db96d2789_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-21-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/2256-16-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/2256-12-0x00000000001C0000-0x00000000001E7000-memory.dmp

Filesize
156KB

Download
memory/2256-9-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/2256-5-0x0000000000200000-0x000000000022F000-memory.dmp

Filesize
188KB

Download
memory/2256-4-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/2256-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2256-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2256-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2256-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2256-25-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download