14e989888ed234522abefa0339b2f439f3319b81f0e49d01a5fa6019b79cc161

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d554c1b263c533a5d044e975e7d5d2af_JaffaCakes118.exe
Size

323KB
MD5

d554c1b263c533a5d044e975e7d5d2af
SHA1

33f15c8b22a3b8244aa2a0dc62edf0d31265f552
SHA256

14e989888ed234522abefa0339b2f439f3319b81f0e49d01a5fa6019b79cc161
SHA512

897291583e6657c8ecf0a1e90a18fe8859c90e3cceb7bd6384cf36ab2bde53212eb771cdef76507561597f5a708bab22fdd1d2b95905bb76f13d22868eb7497c
SSDEEP

6144:wAXP0ECVcLui896rs981zpEL6Zc5885quopN:70Ea+C2yT15q3pN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2944	Light Range.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	d554c1b263c533a5d044e975e7d5d2af_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	d554c1b263c533a5d044e975e7d5d2af_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ScheduleFast.job	d554c1b263c533a5d044e975e7d5d2af_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d554c1b263c533a5d044e975e7d5d2af_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d554c1b263c533a5d044e975e7d5d2af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d554c1b263c533a5d044e975e7d5d2af_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2644

C:\Users\Admin\AppData\Roaming\Light Range\Light Range.exe
"C:\Users\Admin\AppData\Roaming\Light Range\Light Range.exe"
1⤵
- Executes dropped EXE
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Light Range\Light Range.exe

Filesize
64KB

MD5
39070f704c4d1bfd29dfdf206e464db2

SHA1
e4f0f52861d2e2b18686c37454484a9a3acdb1a9

SHA256
5fa873f9e845bc3d2a66b0777d833decc6ebe670a0ae241da39bab5483e70190

SHA512
ee3342df86450cb25cc32175e0bb23eccb83ea8b12708154da2c9330b4e993d468ea5d25e67603166e5db165cb26f31ae02b4b30e56ae6edb3c64f4d24fce319

Download Submit
memory/2644-1-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download
memory/2644-2-0x0000000000180000-0x00000000001AF000-memory.dmp

Filesize
188KB

Download
memory/2644-9-0x00000000001F0000-0x0000000000217000-memory.dmp

Filesize
156KB

Download