854828b473aa77951f6cb8675a3d3d9b9f4b1752a723d861f70f06962d748cf5

General

Target

0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
Size

1.1MB
MD5

0380ae4d63b3dd0353002c916198aa52
SHA1

ccbcbf5978ee5272b91110b85d4f3cbabe0a3ca7
SHA256

854828b473aa77951f6cb8675a3d3d9b9f4b1752a723d861f70f06962d748cf5
SHA512

d1d29999c9a86b0f753a718f82c6b0f77c74f28fca7786cc87e11e1aa645baaa0fcdbac5ab26e63093bd09bc171174fff6246703e231a3e2617a4cae2e8d8e83
SSDEEP

24576:aMjtdFF1r7tQLf/9fOeEfJkgvvEEWhtkk9vrin:FjtHf1oJA1iWyvr

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4160 set thread context of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1600	4564	WerFault.exe	95
4424	4564	WerFault.exe	95

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4564	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
4564	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
4564	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
4564	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
4564	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95
PID 4160 wrote to memory of 4564	4160	0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0380ae4d63b3dd0353002c916198aa52_JaffaCakes118.exe" Track="0001001000"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 2080
    3⤵
    - Program crash
    PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 2024
    3⤵
    - Program crash
    PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4564 -ip 4564
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4564 -ip 4564
1⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4564-0-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-1-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-2-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-3-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-4-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-5-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-6-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-7-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/4564-11-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads