1034595af7b6b8fce9c634d5a016bbc17cff80e360a4e051f054a87f8fba990d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe
Size

317KB
MD5

69e48c43e9f9aa552ef3023250cecfaa
SHA1

d26f6dbaf403eeba2a9d401736e0452d2d6c8aa1
SHA256

1034595af7b6b8fce9c634d5a016bbc17cff80e360a4e051f054a87f8fba990d
SHA512

6f195404957321ea765c4b20f51fc89406f34e25defe0c813dbe1e11f7cff32864ed6727485a9061f1daa8301db722350847a26f4c548b1960002b69c31a4e28
SSDEEP

6144:Ar4t6Y0JQBkQRl7174NpNUM+UHs+WROfyhNfdBitLwN3k51oDGwmA:Ar4t63yRl1uqM+gs+WUf0fdvDGw3

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe

pid	process
1680	69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe
1680	69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe
1680	69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe

pid process

1680 69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe

pid process

1680 69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69e48c43e9f9aa552ef3023250cecfaa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu64DC41D4.dll
Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{4D936499-862D-4728-A5C3-CE0F9670466F}\Custom.dll
Filesize
73KB

MD5
56a2a892987268718445147b7ddd0a98

SHA1
d56fe3883d4d286322981ea07d027554ad52a955

SHA256
5a5245919bb55d392a5e45563af2dc22a15a48a6e9e70b964b7ce339eb02a40f

SHA512
ef0d74fb6747006f9c997e6a43beb4de7cf72fc19000d7949da2c1a6251b9c07aa0c082a549a0b3d3e4a2f5a62682e0346ff8234457ba385488ef874fc600401

Download Submit
\Users\Admin\AppData\Local\Temp\{4D936499-862D-4728-A5C3-CE0F9670466F}\_Setup.dll
Filesize
177KB

MD5
d724fde4415866fac568a449350d1fac

SHA1
9a82ee3744e27a9f0cad8981a3edb5c03f836d61

SHA256
8ce71795858c882f8446e32097e056e64fb7b1b53c6590d86079845afa9a9556

SHA512
5c0abf40a579ffb82f4793a7d04e72254848686899a51cbfb317809b98cc0fb33feab4ab3093ec0497ce167766844948573174c01b5c68d36c0345497d2b8afe

Download Submit