5172a591745d842b14f2627fe73346649c7fe2260a2ce60dbd83dfcd32480852

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea90e14d51be3f759da47e275a979e38_JaffaCakes118.exe
Size

258KB
MD5

ea90e14d51be3f759da47e275a979e38
SHA1

26db1ac3d24e8ba998c3d137924bad1f5eccdf2f
SHA256

5172a591745d842b14f2627fe73346649c7fe2260a2ce60dbd83dfcd32480852
SHA512

95ba4cbaffa059a489672228c9f33d261a1ac4d53109d048eaf6d829bf4110f616ba37f5cde6f34ac2469ca3f13c179da4dee0141c4e77a169ca2a6361a7e793
SSDEEP

3072:0vcP6pi6fZbv4c9nhaWEUZA9msMG4qBMBlOreNh4s7GsPQt2ZpaqXIVNtoMjRHtn:0vcPkfVzh2m5qOl2e0sZaqXS0M1Ht

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2820	Light Brood.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	ea90e14d51be3f759da47e275a979e38_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ea90e14d51be3f759da47e275a979e38_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Mobify.job	ea90e14d51be3f759da47e275a979e38_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea90e14d51be3f759da47e275a979e38_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ea90e14d51be3f759da47e275a979e38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea90e14d51be3f759da47e275a979e38_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2700

C:\Users\Admin\AppData\Roaming\Light Brood\Light Brood.exe
"C:\Users\Admin\AppData\Roaming\Light Brood\Light Brood.exe"
1⤵
- Executes dropped EXE
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Light Brood\Light Brood.exe

Filesize
64KB

MD5
f0b38367b332a9939c62e590425a02bd

SHA1
7d49739c9c2b615272e695404499e3bee7d1c7de

SHA256
d25efaf164eb5a938febcc89c0fa77f94acc7f2604a83a13d01330c55a3f323f

SHA512
5fdc43aab96aaeb124bc469d7b22c347b88fa831af4185cdd97a6e68a2e1565580d184b7f215a5f9ccef3aee17de54f5979a37bdb2091d2c4e0ee31640a4cfef

Download Submit
memory/2700-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2700-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2700-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2700-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2700-4-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2700-9-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2700-16-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2700-12-0x00000000001F0000-0x0000000000217000-memory.dmp

Filesize
156KB

Download
memory/2700-5-0x0000000000160000-0x000000000018F000-memory.dmp

Filesize
188KB

Download
memory/2700-26-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download
memory/2700-28-0x0000000000110000-0x0000000000139000-memory.dmp

Filesize
164KB

Download