11797e7095051047761170c9725b2da2777fcf90b101b15357f7ad7f3653ba31

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

763eb43e7035c007347dbeb9e6c66519_JaffaCakes118.exe
Size

258KB
MD5

763eb43e7035c007347dbeb9e6c66519
SHA1

05c5b9c93bef275b3fd64b5335102d7d7cbe6b5f
SHA256

11797e7095051047761170c9725b2da2777fcf90b101b15357f7ad7f3653ba31
SHA512

8a86c3edff3cd62a358b6404b3733f209047b29e85ae1c1e65bce63bbd54bca76358ca3ddb5d613713f09ec37fbaa9af50a1727a509ffd5a1408d81aff607836
SSDEEP

6144:+wyXAg0HofMukb6rn4v5ZE0JQCnwr87ZGllKd:5g0Harn4vTnwr8EllKd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2604	Disgruntled Village.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	763eb43e7035c007347dbeb9e6c66519_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	763eb43e7035c007347dbeb9e6c66519_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\UltraZing.job	763eb43e7035c007347dbeb9e6c66519_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\763eb43e7035c007347dbeb9e6c66519_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\763eb43e7035c007347dbeb9e6c66519_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2196

C:\Users\Admin\AppData\Roaming\Disgruntled Village\Disgruntled Village.exe
"C:\Users\Admin\AppData\Roaming\Disgruntled Village\Disgruntled Village.exe"
1⤵
- Executes dropped EXE
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Disgruntled Village\Disgruntled Village.exe

Filesize
64KB

MD5
4332aab57614354866f0250dd45ab401

SHA1
84f932294451236c98a706ea565a7a2a7c8bcef7

SHA256
33a5b6daf6e71c4465e3cf84430eba28bf1afaf61ea9768ceef71f52d2b5ae52

SHA512
0c12447df5b4d9264c9732f7f7b2c5fc0974caa8374d66908b3693175f074d9edf4f772aefbd191ee2a955b98ca2b45ee696e62016ea27af0a45a2b06aa5e85c

Download Submit
memory/2196-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2196-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2196-3-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/2196-8-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/2196-11-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2196-4-0x00000000001E0000-0x000000000020F000-memory.dmp

Filesize
188KB

Download
memory/2196-18-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/2196-14-0x00000000007D0000-0x00000000007F7000-memory.dmp

Filesize
156KB

Download
memory/2196-25-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/2196-28-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download