04e843331ed7e6a418200c7eb28728f08914340cbece3f9a8f9360a410ef27d5

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6ea36120a9b8fd31a32b4a55554d088_JaffaCakes118.exe
Size

258KB
MD5

f6ea36120a9b8fd31a32b4a55554d088
SHA1

75ebbd2178ff8790dbe00201ff767b84c5f6c3da
SHA256

04e843331ed7e6a418200c7eb28728f08914340cbece3f9a8f9360a410ef27d5
SHA512

dede536239eb1835963cc8527d8c46bf1253344b3d0c59aa9944002d5f0546279a96339d9423ec26bd5d10dcf01ea0c830135bb1a0dbea7addb2b5a9a194540f
SSDEEP

3072:45FvASDuesPS6Y5yEqEsGr0KpTTWB/FykLwEIRbfbsRBRlHIKcrahl+DeR7nl4:sufJYzqykGbWZVmqlIeR7C

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2184	Clever Team.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	f6ea36120a9b8fd31a32b4a55554d088_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	f6ea36120a9b8fd31a32b4a55554d088_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\TrafficMaster.job	f6ea36120a9b8fd31a32b4a55554d088_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6ea36120a9b8fd31a32b4a55554d088_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f6ea36120a9b8fd31a32b4a55554d088_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6ea36120a9b8fd31a32b4a55554d088_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:276

C:\Users\Admin\AppData\Roaming\Clever Team\Clever Team.exe
"C:\Users\Admin\AppData\Roaming\Clever Team\Clever Team.exe"
1⤵
- Executes dropped EXE
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Clever Team\Clever Team.exe

Filesize
64KB

MD5
562df58924ecc77e73a31e11ad14f95c

SHA1
ad4c9e980cf35e27fc20ca31bb3652163a4d33cd

SHA256
87cb214c129e1681b03592c8344fa44fdd17d707e08b3c692e812a3c9dd4e695

SHA512
3549747fec7e6e86490c078a59a6083a2ea9f7ce72a3b7d0f5766f6a9d55953b979e1bd263c3a8758c2d2628dcdad53a8efb6ee2b8ba315c02ca193adc6df9a5

Download Submit
memory/276-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/276-2-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/276-3-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/276-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/276-9-0x0000000000150000-0x0000000000179000-memory.dmp

Filesize
164KB

Download
memory/276-5-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download
memory/276-4-0x0000000000150000-0x0000000000179000-memory.dmp

Filesize
164KB

Download
memory/276-16-0x0000000000150000-0x0000000000179000-memory.dmp

Filesize
164KB

Download
memory/276-12-0x00000000001E0000-0x0000000000207000-memory.dmp

Filesize
156KB

Download
memory/276-25-0x0000000000150000-0x0000000000179000-memory.dmp

Filesize
164KB

Download
memory/276-28-0x0000000000150000-0x0000000000179000-memory.dmp

Filesize
164KB

Download