13785bd90461a0ae5278db612bf4c617dba72773f5d899f99ff09f84e681c8fd

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4ae017df498395a9c5856fb24882589_JaffaCakes118.exe
Size

255KB
MD5

b4ae017df498395a9c5856fb24882589
SHA1

1b2d574f429fb271fbeeacfb9c901e0ab453d4a7
SHA256

13785bd90461a0ae5278db612bf4c617dba72773f5d899f99ff09f84e681c8fd
SHA512

58f8b410d84c8f30a91ab7fe7763e9e7fcff942a4b70e501db98b1e34914334a46304a7f976eb5df0a02c72380ec069f9c300d0d474e6740804a3e51094f70a0
SSDEEP

6144:gf8VX7/jbFzgEkpWyF966fSdgewsVeMnnk2wMlh:QirrRAv9R6dgdOesnk2jlh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2800	Bold Promise.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	b4ae017df498395a9c5856fb24882589_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	b4ae017df498395a9c5856fb24882589_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SmoothRecorder.job	b4ae017df498395a9c5856fb24882589_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b4ae017df498395a9c5856fb24882589_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4ae017df498395a9c5856fb24882589_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2460

C:\Users\Admin\AppData\Roaming\Bold Promise\Bold Promise.exe
"C:\Users\Admin\AppData\Roaming\Bold Promise\Bold Promise.exe"
1⤵
- Executes dropped EXE
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Bold Promise\Bold Promise.exe

Filesize
64KB

MD5
03ee18f1c3fecae9937f6eb86becc59d

SHA1
ec5b33c659b2952677a58593dd2ee14c9dae4316

SHA256
563fa552ff27b59ce80ac846696f57ebfae7249fe5735613652b2c9779f1ecdc

SHA512
c618aefc6e882ef956c17fe40837994b2fca2dac3706686190867111c474e1307f0b57594b6dcb6be3302047895899a3fcec33478f575a43df815b9a20a15f48

Download Submit
memory/2460-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2460-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2460-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2460-4-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2460-3-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2460-9-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2460-5-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/2460-12-0x00000000001E0000-0x0000000000207000-memory.dmp

Filesize
156KB

Download
memory/2460-16-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2460-25-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download