12b9df2aa3fdd306da370741eadde9e756dce306876f73b355350b5a663c537a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69b320257a710a16c03a589459df504e_JaffaCakes118.exe
Size

258KB
MD5

69b320257a710a16c03a589459df504e
SHA1

3b4baa98ea743580cac6f3cff251e7bd98011eaf
SHA256

12b9df2aa3fdd306da370741eadde9e756dce306876f73b355350b5a663c537a
SHA512

a443ec90ba1f14cc406b3462b3ec38b75b13016546c9505e806ac550bd1043a235bf805db5f68a889a6a5eff3fb08bf1c31e930812a3cd5581e25b59fe0a030c
SSDEEP

3072:38+g1CvAqReXVbfQEBP3BO+WSRcR1kiVfUyL84OiaYKbekKCVc9q55BjDsmKI8/c:38+gkrKDz8QODccML+9qv94mM3w5F

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Bold Brood.exe

pid process

2664 Bold Brood.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2664	Bold Brood.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

69b320257a710a16c03a589459df504e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	69b320257a710a16c03a589459df504e_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	69b320257a710a16c03a589459df504e_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

Processes:

69b320257a710a16c03a589459df504e_JaffaCakes118.exe

description ioc process

File created C:\Windows\Tasks\WebTracker.job 69b320257a710a16c03a589459df504e_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\Tasks\WebTracker.job	69b320257a710a16c03a589459df504e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\69b320257a710a16c03a589459df504e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69b320257a710a16c03a589459df504e_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2116

C:\Users\Admin\AppData\Roaming\Bold Brood\Bold Brood.exe
"C:\Users\Admin\AppData\Roaming\Bold Brood\Bold Brood.exe"
1⤵
- Executes dropped EXE
PID:2664

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Bold Brood\Bold Brood.exe
Filesize
64KB

MD5
7d9b7f43317e977254c19b8c01bd6d05

SHA1
ece29058560fa5124000f85bc6d3cfce8aa0a51a

SHA256
d84131669d07e1cf8b72dbb75abe77a86c5ef6d7a70dc7a0a812962515a04047

SHA512
93d9bb4123a99b2778d4835a263b31a2d3b3b6d43957a6f8705b4be491453344a8a5ada4a475ada08a37dd3556a9c8340706e4f32cab186c8954744e67ad1e26

Download Submit
memory/2116-2-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2116-0-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2116-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2116-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2116-9-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2116-5-0x0000000000160000-0x000000000018F000-memory.dmp

Filesize
188KB

Download
memory/2116-16-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2116-12-0x00000000001B0000-0x00000000001D7000-memory.dmp

Filesize
156KB

Download
memory/2116-26-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2116-28-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download