25a405613a35cf0f2eb8452a5d95f62132e3e0dd1e6959f28c19fe2d78951907

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5149d43ac0e13fea12d8a364366ab38_JaffaCakes118.exe
Size

323KB
MD5

b5149d43ac0e13fea12d8a364366ab38
SHA1

19c377248a271ce327ac5a99a2e7482d42c6f042
SHA256

25a405613a35cf0f2eb8452a5d95f62132e3e0dd1e6959f28c19fe2d78951907
SHA512

a6504a4cfb679df65ceb4c38c1acdb1b801615538010adbcee5bcc7cdf856d5a87e66f1304cb5960307cd42583a3f2cb3210663bbfcfb02078b77b8ee8eb8da5
SSDEEP

6144:nBDGGj8Ti/LXFMYAAH8/k556EdfFAGflLD:tGGjE2DFM5858EDAGfpD

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2764	Sarcastic Promise.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	b5149d43ac0e13fea12d8a364366ab38_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	b5149d43ac0e13fea12d8a364366ab38_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DailyJive.job	b5149d43ac0e13fea12d8a364366ab38_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b5149d43ac0e13fea12d8a364366ab38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5149d43ac0e13fea12d8a364366ab38_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:1768

C:\Users\Admin\AppData\Roaming\Sarcastic Promise\Sarcastic Promise.exe
"C:\Users\Admin\AppData\Roaming\Sarcastic Promise\Sarcastic Promise.exe"
1⤵
- Executes dropped EXE
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sarcastic Promise\Sarcastic Promise.exe

Filesize
64KB

MD5
72d6b6cc49112e67582e205675402dd3

SHA1
4aabd26be7a77f7bfb2e3c50d3cae20e18c945fd

SHA256
5935d8309c9e34b88f533b8968f33f5c7c51d4a8687056f6a83a9434fb3ca795

SHA512
a4868fdf304c1d6a971bee3f0aa1a86d989335830a009dd5d9ec1ba9d318a21b4814a8ecfecc45f234ebc5ffccc82313413f2958f5232720d4fabaf6c064458b

Download Submit
memory/1768-0-0x0000000000A60000-0x0000000000AA0000-memory.dmp

Filesize
256KB

Download
memory/1768-3-0x00000000000F0000-0x000000000011F000-memory.dmp

Filesize
188KB

Download
memory/1768-9-0x0000000000170000-0x0000000000197000-memory.dmp

Filesize
156KB

Download