0601591ff6ae3286ac174a5ff9d4d23a49ce1748c62a15a507841db2b0173f50

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f24fc368271f3093a497e6e7e92def1_JaffaCakes118.exe
Size

258KB
MD5

8f24fc368271f3093a497e6e7e92def1
SHA1

01d243be3c0c2085deb17db942d2518d1982e7d6
SHA256

0601591ff6ae3286ac174a5ff9d4d23a49ce1748c62a15a507841db2b0173f50
SHA512

a1acb5465644e88199fa5fa76a494c16f26bb0672e40015a8528e4aa145e8d7bd6a046a5cdf9e05796013aacbb3ce2807e3bc6b80d7dd216a6870d22dcec14b1
SSDEEP

3072:3Oot+g1CvAquaXVbfQEMP3BO+WSRcR1kiVfQUyL84OiaYKbekKCVc9q55BjDsm1J:3Oot+gkrBDS8QOD6ecML+9qv94mmow5M

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2084	Light Caravan.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	8f24fc368271f3093a497e6e7e92def1_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	8f24fc368271f3093a497e6e7e92def1_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TaxiHub.job	8f24fc368271f3093a497e6e7e92def1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8f24fc368271f3093a497e6e7e92def1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f24fc368271f3093a497e6e7e92def1_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1956

C:\Users\Admin\AppData\Roaming\Light Caravan\Light Caravan.exe
"C:\Users\Admin\AppData\Roaming\Light Caravan\Light Caravan.exe"
1⤵
- Executes dropped EXE
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Light Caravan\Light Caravan.exe

Filesize
64KB

MD5
07204629a656e53fca91a82bd8035e2d

SHA1
7d585dc17737a33833963b2fca2e4250e63c284b

SHA256
c5723606651eb436760cb49ee941bbaae1be3c9956ecbb906549916f525fcc71

SHA512
82821499397560502d9241747188f9f9001cc3ad6a4a1c0ea12de71f798c26ab37c388ef87a450a9a854e4a5259637b293b43b3e3139a3d8e684f947328392a8

Download Submit
memory/1956-2-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1956-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1956-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1956-4-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1956-3-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1956-5-0x00000000001F0000-0x000000000021F000-memory.dmp

Filesize
188KB

Download
memory/1956-12-0x0000000000220000-0x0000000000247000-memory.dmp

Filesize
156KB

Download
memory/1956-16-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1956-9-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download
memory/1956-26-0x00000000001A0000-0x00000000001C9000-memory.dmp

Filesize
164KB

Download