Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:22
Behavioral task
behavioral1
Sample
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe
-
Size
666KB
-
MD5
03c19f682f1d136506cb4d57ccae4016
-
SHA1
1c0ee1ec6682884ddb5295b5edb141d4ff1a7b26
-
SHA256
b1fea92292d31a42ed32e07adafa3659948b7401e7cffade033e5316a46bd9ec
-
SHA512
8c1ca59da6d5cae5db16c0fc258d4e0bcddc2e369deb2efc1227c6dbfdbdeea45ad5b7c950603f0928b86b26aebbdbde5f972848ce21f0364ab94d387bab6d77
-
SSDEEP
12288:qbDqEkMs4q48IAeP0PifTEurPbvdqJplapLWTICNIYPKMTWN4t4OAUw91zRwIMfe:qXbs48LeP0P8E6dclWLi26KGOqMwIMG
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2008-0-0x0000000000400000-0x00000000005C7000-memory.dmp upx behavioral1/memory/2008-28-0x0000000000400000-0x00000000005C7000-memory.dmp upx behavioral1/memory/2008-29-0x0000000000400000-0x00000000005C7000-memory.dmp upx behavioral1/memory/2008-30-0x0000000000400000-0x00000000005C7000-memory.dmp upx behavioral1/memory/2008-31-0x0000000000400000-0x00000000005C7000-memory.dmp upx behavioral1/memory/2008-32-0x0000000000400000-0x00000000005C7000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe -
Processes:
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exepid process 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe 2008 03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03c19f682f1d136506cb4d57ccae4016_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2008-0-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB
-
memory/2008-28-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB
-
memory/2008-29-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB
-
memory/2008-30-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB
-
memory/2008-31-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB
-
memory/2008-32-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB