23e80ac40432e79930e84fcf056c0f2d8768865310b12b385a7f60e7b4bfd117

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66c84be205e350a56f085ddf7a3bb5fb_JaffaCakes118.exe
Size

259KB
MD5

66c84be205e350a56f085ddf7a3bb5fb
SHA1

02253c55066bb3898cf3e6a7f75c42025302f41d
SHA256

23e80ac40432e79930e84fcf056c0f2d8768865310b12b385a7f60e7b4bfd117
SHA512

1723c078ecdeb36e7ccd1ec24e4204ebbe36ae1dbefa3364a0f833910630b7cc635ca9a393cd24993def30dfd30fc243b6266c25d6d368e6814aa352c0538f09
SSDEEP

3072:zm3PIYCvrOLuKEMmEY6vVGWKxkBCKNj6tohryJddqf8QSa1r4Kf6wEP8/ltn5i5p:zcPgb+BUKYOheJdsf8QSa1uOlDg7b

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2648	Fresh Knowledge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	66c84be205e350a56f085ddf7a3bb5fb_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	66c84be205e350a56f085ddf7a3bb5fb_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AbsoluteKitchen.job	66c84be205e350a56f085ddf7a3bb5fb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\66c84be205e350a56f085ddf7a3bb5fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66c84be205e350a56f085ddf7a3bb5fb_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2140

C:\Users\Admin\AppData\Roaming\Fresh Knowledge\Fresh Knowledge.exe
"C:\Users\Admin\AppData\Roaming\Fresh Knowledge\Fresh Knowledge.exe"
1⤵
- Executes dropped EXE
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Fresh Knowledge\Fresh Knowledge.exe

Filesize
64KB

MD5
45a20f5683fc64d1edd7da7bc91effc1

SHA1
4e96e2390fcbf519f499a6eefb30d7d0920e8398

SHA256
ed1092fe768042c4e36f7944396246d40cb8b4a9cbd38e01aafda191171c5da1

SHA512
99a7cbb26d99d729d7a53e34d06571c03a990d625669ee761200dbccd7830114735cb34b1d1034a5670b1211b4978a4027acd032b2e1ff84ae942d00da76cdd4

Download Submit
memory/2140-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2140-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2140-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2140-3-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2140-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2140-9-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2140-5-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download
memory/2140-16-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2140-12-0x00000000006B0000-0x00000000006D7000-memory.dmp

Filesize
156KB

Download
memory/2140-25-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2140-28-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download