0606192019c437960df59ae9f5193e653adf42a5a7420fe7cb171ffa248901df

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6a82e32fba9101a6d6b20a4f0fe47f1_JaffaCakes118.exe
Size

259KB
MD5

a6a82e32fba9101a6d6b20a4f0fe47f1
SHA1

08b8cd543275e7207f44115388856b771a2e089a
SHA256

0606192019c437960df59ae9f5193e653adf42a5a7420fe7cb171ffa248901df
SHA512

c453e2d297d1d995cd87e7c23e1b9a6ce5b4952225330d061d2b8e69157ba3ed5404b3de089bee8ba89d54e0182e3e785e57e602f9b836d3070d9b130c31d3b7
SSDEEP

6144:MpPgyulBUKYOheJdsf8QSa1uOl/ZLhGF7n:M1giK3eJ6EQnllzGF7n

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	Devoted Bigotry.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	a6a82e32fba9101a6d6b20a4f0fe47f1_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	a6a82e32fba9101a6d6b20a4f0fe47f1_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ModifyCommands.job	a6a82e32fba9101a6d6b20a4f0fe47f1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a6a82e32fba9101a6d6b20a4f0fe47f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6a82e32fba9101a6d6b20a4f0fe47f1_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1740

C:\Users\Admin\AppData\Roaming\Devoted Bigotry\Devoted Bigotry.exe
"C:\Users\Admin\AppData\Roaming\Devoted Bigotry\Devoted Bigotry.exe"
1⤵
- Executes dropped EXE
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Devoted Bigotry\Devoted Bigotry.exe

Filesize
64KB

MD5
d6d2f5298dc08a8fa0f2ae73a8d056e9

SHA1
dba12a4435925f4f5da0b120ac05e7cd5ed576b0

SHA256
d84b0a15c7c5c0517071adced8cbfc5784bb8db7c31e565467ec5d8faf32e64a

SHA512
67796273c549949230093f34f728fafd3126aa6645c73358c012f823cc29c1255c112d205a6b489837bd23ba72033c5e71629e69f6be2fae9c473186b3a1cce8

Download Submit
memory/1740-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1740-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1740-3-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/1740-4-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1740-5-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/1740-12-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download
memory/1740-16-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/1740-9-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/1740-26-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download
memory/1740-28-0x0000000000170000-0x0000000000199000-memory.dmp

Filesize
164KB

Download