bd459a9bde677fcdfe17525e087ec5a5b742fc98b0a7898e152d0712788ad435

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
Size

140KB
MD5

19743945fd57f60f77b4338f49206386
SHA1

b13ec6b484d6127894ec83d0a10f381599cdc28f
SHA256

bd459a9bde677fcdfe17525e087ec5a5b742fc98b0a7898e152d0712788ad435
SHA512

eeec50a20e6c84311eb190d4c2784b815f32cd45fe6b10ee10fcf384107a7aa7d367219a5e03966f13862eb1e9a2ef9583ead4717dbdafa66da75dc75d4e103f
SSDEEP

3072:hdQaC0defyEh4O5uXjHEE++3dvZJxr7nJtGg:IaCOeRh4FjEELNvRbJI

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\P:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\W:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\Y:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\T:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\V:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\X:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\J:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\K:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\L:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\M:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\O:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\B:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\I:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\Q:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\R:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\S:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\Z:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\A:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\E:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\G:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\N:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
File opened (read-only)	\??\U:	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	19743945fd57f60f77b4338f49206386_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\19743945fd57f60f77b4338f49206386_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19743945fd57f60f77b4338f49206386_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-2-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/2420-3-0x0000000004EE0000-0x00000000050A3000-memory.dmp

Filesize
1.8MB

Download
memory/2420-6-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/2420-7-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/2420-5-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/2420-4-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/2420-8-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/2420-10-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/2420-9-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/2420-11-0x0000000005210000-0x00000000053AE000-memory.dmp

Filesize
1.6MB

Download