11ec20a330e6cc151db2d3234edd7b24f0557d6ed155129f5211d6061f2aeda4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c5d83e6e487982c4b7749dfe6345d2c_JaffaCakes118.exe
Size

322KB
MD5

8c5d83e6e487982c4b7749dfe6345d2c
SHA1

e19028fe0f43f07295c16e72a04fd81a1e00d8f1
SHA256

11ec20a330e6cc151db2d3234edd7b24f0557d6ed155129f5211d6061f2aeda4
SHA512

5514c7dead108e4d1151eceb0cd02e4f26ba9257b252a15a4c484f7589dbf00d7bb6eb283b2d30e29ac2b75eae8945707be304ef1d42822a18593155236a611f
SSDEEP

6144:0DrUbhmcfz9xAIFHdCI8kAO6l1cHZjqf/i:0nUbhmchxAMHdCsH5jqf/i

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2748	Intelligent Freedom.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	8c5d83e6e487982c4b7749dfe6345d2c_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	8c5d83e6e487982c4b7749dfe6345d2c_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SearchFunction.job	8c5d83e6e487982c4b7749dfe6345d2c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8c5d83e6e487982c4b7749dfe6345d2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c5d83e6e487982c4b7749dfe6345d2c_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2248

C:\Users\Admin\AppData\Roaming\Intelligent Freedom\Intelligent Freedom.exe
"C:\Users\Admin\AppData\Roaming\Intelligent Freedom\Intelligent Freedom.exe"
1⤵
- Executes dropped EXE
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Intelligent Freedom\Intelligent Freedom.exe

Filesize
64KB

MD5
739dc93e9e4ec34c6c557074158087bd

SHA1
2f121d8b9dfb9470659f0ac7517064da3f56fc9d

SHA256
3fd6398e50c915b509a59a37f9b83fd15e8fca03e4af8980c04b8ca0f5870ac9

SHA512
91ba40341d44ea13f55c01b3f0fc76cd4e0bc4524c19b7b3986a2f2a0e9afd10167bd992c8f98d96dc4c5bf7509bf3dfbdd685e1244df90f3e13daf9064a016d

Download Submit
memory/2248-0-0x0000000001120000-0x0000000001160000-memory.dmp

Filesize
256KB

Download
memory/2248-3-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download
memory/2248-9-0x00000000026F0000-0x0000000002717000-memory.dmp

Filesize
156KB

Download