23cbd4a93f0978351345b7b418da7ef40d84f9d732481491ee564443905b5fe5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa184c669ef7336de6d6686bd80762d_JaffaCakes118.exe
Size

257KB
MD5

eaa184c669ef7336de6d6686bd80762d
SHA1

315a8cba591e1f47fd5092a20a8e02ca6bf9278c
SHA256

23cbd4a93f0978351345b7b418da7ef40d84f9d732481491ee564443905b5fe5
SHA512

a3046ff2d134f33c350ac2cfd0c8cdcc53a1387abf8a3e4e16ae467f8981568043ed8b8d94c6c29147a71484485e0988091d46fdc42f88162b9b94607d8af943
SSDEEP

6144:jqR0kN/j+2EPlDvxGt2vjDf8hn+m/H7m:Gfh+2EtjxY2vjDfG+EH7m

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2804	Startled Hope.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	eaa184c669ef7336de6d6686bd80762d_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	eaa184c669ef7336de6d6686bd80762d_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GroovyLayout.job	eaa184c669ef7336de6d6686bd80762d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaa184c669ef7336de6d6686bd80762d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eaa184c669ef7336de6d6686bd80762d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eaa184c669ef7336de6d6686bd80762d_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2684

C:\Users\Admin\AppData\Roaming\Startled Hope\Startled Hope.exe
"C:\Users\Admin\AppData\Roaming\Startled Hope\Startled Hope.exe"
1⤵
- Executes dropped EXE
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Startled Hope\Startled Hope.exe

Filesize
64KB

MD5
141c6508c2573ef07d1f5b73dcf775c4

SHA1
b85be50ea0cfd348e105f6fbe63704885d6aa763

SHA256
4cf159f52e7ad09db7942f700a4d4cbf7158aae114dce76052cd1fd660507066

SHA512
9fa6b5ed08b2b5db63e8682515c9c256ab46df4fb30d3fdc71baa1d357e22f4aa8ff77657fd5f49ae52b43610d2ee2145eaeb40e2b6956efee787a9814438e9a

Download Submit
memory/2684-3-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2684-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2684-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2684-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2684-4-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download
memory/2684-9-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download
memory/2684-12-0x00000000005D0000-0x00000000005F7000-memory.dmp

Filesize
156KB

Download
memory/2684-16-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download
memory/2684-5-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/2684-26-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download
memory/2684-28-0x00000000000E0000-0x0000000000109000-memory.dmp

Filesize
164KB

Download