865b262aae18e98f132f4f974848a23f9b517cb452c5eb51ba24a10502b9fef3

Analysis

max time kernel
142s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdedd9bbc7a64964a7225cfabd93c000_JaffaCakes118.exe
Size

103KB
MD5

cdedd9bbc7a64964a7225cfabd93c000
SHA1

c359361c43e0dda2661f1b8640f6d3b658ecfbc7
SHA256

865b262aae18e98f132f4f974848a23f9b517cb452c5eb51ba24a10502b9fef3
SHA512

d2872e6cc02a0a59c5acc36a33aff8cc631630103f32ac21b2eedf6ab26eadb899e0a5d3a42bfa559b6de6925c381a7c2b74d5721ec260ea910c0e705dcf53de
SSDEEP

1536:mXqtQ3n1pInA7KTFItBhjlH2cniirNPbbeIJBn2+ccCS+hDu9xbFdp86O:X+1p/6FItB3WcVr5eIJBn2+ZR+k9Zx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2348	zbapv.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	zbapv.exe
File opened (read-only)	\??\V:	zbapv.exe
File opened (read-only)	\??\L:	zbapv.exe
File opened (read-only)	\??\N:	zbapv.exe
File opened (read-only)	\??\P:	zbapv.exe
File opened (read-only)	\??\S:	zbapv.exe
File opened (read-only)	\??\U:	zbapv.exe
File opened (read-only)	\??\W:	zbapv.exe
File opened (read-only)	\??\E:	zbapv.exe
File opened (read-only)	\??\J:	zbapv.exe
File opened (read-only)	\??\K:	zbapv.exe
File opened (read-only)	\??\T:	zbapv.exe
File opened (read-only)	\??\X:	zbapv.exe
File opened (read-only)	\??\H:	zbapv.exe
File opened (read-only)	\??\I:	zbapv.exe
File opened (read-only)	\??\G:	zbapv.exe
File opened (read-only)	\??\M:	zbapv.exe
File opened (read-only)	\??\O:	zbapv.exe
File opened (read-only)	\??\R:	zbapv.exe
File opened (read-only)	\??\Y:	zbapv.exe
File opened (read-only)	\??\Z:	zbapv.exe
File opened (read-only)	\??\A:	zbapv.exe
File opened (read-only)	\??\B:	zbapv.exe

C:\Users\Admin\AppData\Local\Temp\cdedd9bbc7a64964a7225cfabd93c000_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cdedd9bbc7a64964a7225cfabd93c000_JaffaCakes118.exe"
1⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\zbapv.exe
C:\Users\Admin\AppData\Local\Temp\zbapv.exe -svc
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zbapv.exe

Filesize
103KB

MD5
cdedd9bbc7a64964a7225cfabd93c000

SHA1
c359361c43e0dda2661f1b8640f6d3b658ecfbc7

SHA256
865b262aae18e98f132f4f974848a23f9b517cb452c5eb51ba24a10502b9fef3

SHA512
d2872e6cc02a0a59c5acc36a33aff8cc631630103f32ac21b2eedf6ab26eadb899e0a5d3a42bfa559b6de6925c381a7c2b74d5721ec260ea910c0e705dcf53de

Download Submit
memory/2140-32-0x0000000000230000-0x0000000000249000-memory.dmp

Filesize
100KB

Download
memory/2140-1-0x0000000000230000-0x0000000000249000-memory.dmp

Filesize
100KB

Download
memory/2140-2-0x0000000000230000-0x0000000000249000-memory.dmp

Filesize
100KB

Download
memory/2140-11-0x0000000000230000-0x0000000000249000-memory.dmp

Filesize
100KB

Download
memory/2140-31-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2140-0-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2348-24-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/2348-27-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/2348-26-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/2348-28-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/2348-30-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/2348-25-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/2348-15-0x00000000002B0000-0x00000000002C9000-memory.dmp

Filesize
100KB

Download
memory/2348-33-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download