132bc36d7cd7ad4747b6606f95589c619c916b9a4ec558eff3798f246d5566c9

General

Target

797b363d8699ec9a437b337dfc60cff8_JaffaCakes118.exe
Size

2.5MB
MD5

797b363d8699ec9a437b337dfc60cff8
SHA1

e3f542cdd38804a038e51e5f61133f984a62fd69
SHA256

132bc36d7cd7ad4747b6606f95589c619c916b9a4ec558eff3798f246d5566c9
SHA512

cfad0f0590b0eecc6e49710071dfca5a2f3ebd072c625be0bde448e5be59fde31e005806520a3fe9aac897a7e18b5d4acab12f62cc5333b6ceace0c660575a4b
SSDEEP

12288:67Ta7+50jobj2lrkF5Y46kmDQmozdbsAN:iTa7+bbjcrkc47EwIAN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2828	Foolish Infancy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	797b363d8699ec9a437b337dfc60cff8_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	797b363d8699ec9a437b337dfc60cff8_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	797b363d8699ec9a437b337dfc60cff8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\797b363d8699ec9a437b337dfc60cff8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\797b363d8699ec9a437b337dfc60cff8_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1996

C:\Users\Admin\AppData\Roaming\Foolish Infancy\Foolish Infancy.exe
"C:\Users\Admin\AppData\Roaming\Foolish Infancy\Foolish Infancy.exe"
1⤵
- Executes dropped EXE
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Foolish Infancy\Foolish Infancy.exe

Filesize
63KB

MD5
818ea6bd57288d86b461acbfbe9a2660

SHA1
dec29eb7a7757173db73f08ad244349a3f8f2676

SHA256
e36c269b3065ad15f808274361a8479d24d9cbdb32bed0b01e79960a74f6bab3

SHA512
9db6b0ff0857016a5d9cfc1b2b52548a0f3d025bb5e0e06accf1d30f5bf9df15ab7f5429433085137a33273b9c74b78cb18f2cce3800be33362196d25933f643

Download Submit
memory/1996-17-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1996-21-0x00000000007E0000-0x000000000080F000-memory.dmp

Filesize
188KB

Download
memory/1996-7-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1996-6-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1996-5-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1996-4-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1996-3-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1996-2-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1996-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1996-12-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1996-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1996-10-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1996-16-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1996-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1996-8-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1996-15-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/1996-29-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1996-18-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/1996-20-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1996-19-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1996-14-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1996-30-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/1996-13-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1996-34-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1996-28-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1996-27-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/1996-26-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/1996-25-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1996-35-0x00000000008F0000-0x0000000000916000-memory.dmp

Filesize
152KB

Download
memory/1996-9-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing