045f0ec1315b6309b6ebae5fbe70e72b91f8b3f3a4ad810e020949b8507e09b1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1d63f171a13d96673445c4db51547f2_JaffaCakes118.exe
Size

259KB
MD5

b1d63f171a13d96673445c4db51547f2
SHA1

92d156fa3188f2de5c38438e5138af1f119d76e6
SHA256

045f0ec1315b6309b6ebae5fbe70e72b91f8b3f3a4ad810e020949b8507e09b1
SHA512

d4d971c61e34fb51237728f67e992008c15c3dca38d9445a924eecdd18baade2f29be9e8cdaa7acd34dcbd0a5411f17a4188a73265763b22cc84abd2fd8bee99
SSDEEP

6144:+zrxg8OH79Z1P/R8qVjFBkCVvFJtIlc5Xs/qrc+:+fa8GN6q9FBkCRWx/qrc+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2584	Outraged Family.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	b1d63f171a13d96673445c4db51547f2_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	b1d63f171a13d96673445c4db51547f2_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MasterCleaner.job	b1d63f171a13d96673445c4db51547f2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b1d63f171a13d96673445c4db51547f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b1d63f171a13d96673445c4db51547f2_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1608

C:\Users\Admin\AppData\Roaming\Outraged Family\Outraged Family.exe
"C:\Users\Admin\AppData\Roaming\Outraged Family\Outraged Family.exe"
1⤵
- Executes dropped EXE
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Outraged Family\Outraged Family.exe

Filesize
64KB

MD5
f781afcfb217cbfa49858776813a2666

SHA1
9407c11b6108abc45284de5716267198a54de7c4

SHA256
ca3246179ffd70a8accd3a42257c407c8ecf12286ecc32703feca76662062eb5

SHA512
bceb491aeeb33e058ecd73cd24ceae8c8c185084a229c3a8cd365b3b67d7c0fe3e31844d5a2e6fa96b43ec595175ca45694cab578089e1d36396122d64250f11

Download Submit
memory/1608-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1608-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1608-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1608-4-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/1608-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1608-9-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/1608-5-0x0000000000200000-0x000000000022F000-memory.dmp

Filesize
188KB

Download
memory/1608-16-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/1608-12-0x0000000000230000-0x0000000000257000-memory.dmp

Filesize
156KB

Download
memory/1608-26-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/1608-28-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download