085910d57a0b1b68ec8c79b3e2142d87d2b337e5a33aeb63ebeaadd8d6b6edd7

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

354e468c952edb81f263f809a852c795_JaffaCakes118.exe
Size

268KB
MD5

354e468c952edb81f263f809a852c795
SHA1

8f80ab81f8b6d1af5ae12458656b4bee0e18b6f3
SHA256

085910d57a0b1b68ec8c79b3e2142d87d2b337e5a33aeb63ebeaadd8d6b6edd7
SHA512

1421c3d6e61baa62b861ff2c42c69f438201fa0d624a278042fcf1b00161bec1b5a058a741a2125a858a5f50750ed17a0e6ca0ee0b8d15a7ff35853bd19e5678
SSDEEP

3072:01t3tLAoUHvNGw43rUHVDa8+ZsyRoovmsRL4TNDtKI9IMMkhSf3qfKDsbi0sf1p6:01tGoUVoNv+TxtKIOMhhuEKD7ZANk6

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	fkw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DBF2D462 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fkw.exe"	354e468c952edb81f263f809a852c795_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	fkw.exe
File opened (read-only)	\??\Z:	fkw.exe
File opened (read-only)	\??\A:	fkw.exe
File opened (read-only)	\??\B:	fkw.exe
File opened (read-only)	\??\L:	fkw.exe
File opened (read-only)	\??\N:	fkw.exe
File opened (read-only)	\??\S:	fkw.exe
File opened (read-only)	\??\H:	fkw.exe
File opened (read-only)	\??\P:	fkw.exe
File opened (read-only)	\??\Q:	fkw.exe
File opened (read-only)	\??\R:	fkw.exe
File opened (read-only)	\??\V:	fkw.exe
File opened (read-only)	\??\W:	fkw.exe
File opened (read-only)	\??\X:	fkw.exe
File opened (read-only)	\??\I:	fkw.exe
File opened (read-only)	\??\K:	fkw.exe
File opened (read-only)	\??\O:	fkw.exe
File opened (read-only)	\??\U:	fkw.exe
File opened (read-only)	\??\T:	fkw.exe
File opened (read-only)	\??\E:	fkw.exe
File opened (read-only)	\??\G:	fkw.exe
File opened (read-only)	\??\J:	fkw.exe
File opened (read-only)	\??\M:	fkw.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\6B5D5A3C = "3930218864"	fkw.exe

C:\Users\Admin\AppData\Local\Temp\354e468c952edb81f263f809a852c795_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\354e468c952edb81f263f809a852c795_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
PID:2700

C:\Users\Admin\AppData\Local\Temp\fkw.exe
C:\Users\Admin\AppData\Local\Temp\fkw.exe -svc
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies Internet Explorer settings
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fkw.exe

Filesize
268KB

MD5
354e468c952edb81f263f809a852c795

SHA1
8f80ab81f8b6d1af5ae12458656b4bee0e18b6f3

SHA256
085910d57a0b1b68ec8c79b3e2142d87d2b337e5a33aeb63ebeaadd8d6b6edd7

SHA512
1421c3d6e61baa62b861ff2c42c69f438201fa0d624a278042fcf1b00161bec1b5a058a741a2125a858a5f50750ed17a0e6ca0ee0b8d15a7ff35853bd19e5678

Download Submit
memory/2700-33-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2700-2-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2700-11-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2700-1-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2700-32-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2700-0-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/2844-26-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2844-28-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2844-30-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2844-27-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2844-29-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2844-24-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2844-25-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2844-34-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2844-36-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads