Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
- submitted
13/06/2024, 05:39
General
- Target a40718049568062a27a4b65fafc47f56_JaffaCakes118.exe
- Size 340KB
- Sample240613-gcfcmszdnr
- SHA256 358acee4a278999b4e567c8af901b26c72103e3c52ccf3f768f08a9131125dc8
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in Windows directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40718049568062a27a4b65fafc47f56_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a40718049568062a27a4b65fafc47f56_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Roaming\Believing Bevy\Believing Bevy.exe"C:\Users\Admin\AppData\Roaming\Believing Bevy\Believing Bevy.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Believing Bevy.exe
memory/3044-1-0x0000000000030000-0x0000000000031000-memory.dmp
memory/3044-0-0x0000000000020000-0x0000000000021000-memory.dmp
memory/3044-2-0x0000000000080000-0x0000000000081000-memory.dmp
memory/3044-3-0x00000000000D0000-0x00000000000D1000-memory.dmp
memory/3044-4-0x00000000001F0000-0x0000000000219000-memory.dmp
memory/3044-5-0x0000000000220000-0x000000000024F000-memory.dmp
memory/3044-9-0x00000000001F0000-0x0000000000219000-memory.dmp
memory/3044-16-0x00000000001F0000-0x0000000000219000-memory.dmp
memory/3044-12-0x0000000000650000-0x0000000000677000-memory.dmp
memory/3044-25-0x00000000001F0000-0x0000000000219000-memory.dmp