1132e6eddb8a036f440687d90c5a3e28f0c04e2d130be3ba5aea93f6702a80cb

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e2d69f76620872badd27be3168d2ac6_JaffaCakes118.exe
Size

323KB
MD5

9e2d69f76620872badd27be3168d2ac6
SHA1

4f394046d4c8f276bb1ed55ae7b491e1e99d3007
SHA256

1132e6eddb8a036f440687d90c5a3e28f0c04e2d130be3ba5aea93f6702a80cb
SHA512

3ff464f7f63782f412ccfd7d506950ec621f1e2241dea38ac0dde0a022e467f4368071c45c6debe7cde4cdf344fa504af972ca292ad2176f2d4c638d1a56ac29
SSDEEP

3072:6AXPiWAyXzHTrmVTQIKLHOQmpg8sYvV4w6rsGzktr+xJhPB11zauwOEujSvWBNcn:6AXP0ECVcLui896rs981zpIvIOp+msfO

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2768	Guilty Heroism.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	9e2d69f76620872badd27be3168d2ac6_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	9e2d69f76620872badd27be3168d2ac6_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\EasyTrain.job	9e2d69f76620872badd27be3168d2ac6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9e2d69f76620872badd27be3168d2ac6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e2d69f76620872badd27be3168d2ac6_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2840

C:\Users\Admin\AppData\Roaming\Guilty Heroism\Guilty Heroism.exe
"C:\Users\Admin\AppData\Roaming\Guilty Heroism\Guilty Heroism.exe"
1⤵
- Executes dropped EXE
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Guilty Heroism\Guilty Heroism.exe

Filesize
64KB

MD5
a2561f60761a6d6d04eb189623b7a3e2

SHA1
331c6d002f4403c96fe813264a7884e7ba50859d

SHA256
bbb81ce1884ef9f5c04ca9395b683a6c1188fdef5634409db17ebf9148a2fe67

SHA512
135605e70140ad232f060fedbc45a511e31fdfc4d868379603be77d7e36d6e11a1b777347a8b00a173952eab9a09e86523c132c199a9879dcff95a958085a891

Download Submit
memory/2840-1-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download
memory/2840-2-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/2840-9-0x0000000000140000-0x0000000000167000-memory.dmp

Filesize
156KB

Download
memory/2840-26-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download