Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:37
Static task
static1
Behavioral task
behavioral1
Sample
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe
-
Size
853KB
-
MD5
63fd6df25b6e20592e17e581087937e2
-
SHA1
ab9054682b9742fb433c29652fe09af5416c8aaf
-
SHA256
9cd65f173a8b0b1cbb9f3a304bd9ce2d6df9e6680afce196980f138454cbe71a
-
SHA512
c1f18b60fe1f8b21d073f4b12dac2ee935c03683a327a51483a770edbabb34d2553625ff2aae5750bb03ab53cccc5282c1d30df41dc71e62280c8dbd28766680
-
SSDEEP
24576:1Yq2/9nnr5cDNsOQfKJL9ki1arPvi/cjaBYfv:mqaxyDC2JmSoPvikO8
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exedescription pid process target process PID 2964 set thread context of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe -
Processes:
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exepid process 2640 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 2640 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 2640 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 2640 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 2640 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 2640 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exedescription pid process target process PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe PID 2964 wrote to memory of 2640 2964 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe 63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63fd6df25b6e20592e17e581087937e2_JaffaCakes118.exe" Track="0001001000"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2640-27-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-36-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-12-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-3-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-44-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-24-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-43-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-26-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-18-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-29-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-42-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-13-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-9-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-8-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-5-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-25-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-23-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-41-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2640-28-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-31-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-32-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-33-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-34-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-35-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-40-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-37-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-38-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2640-39-0x0000000000400000-0x0000000000522000-memory.dmpFilesize
1.1MB
-
memory/2964-0-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/2964-21-0x00000000001C0000-0x00000000001C3000-memory.dmpFilesize
12KB
-
memory/2964-15-0x0000000002790000-0x00000000028AC000-memory.dmpFilesize
1.1MB
-
memory/2964-22-0x0000000000400000-0x000000000051C000-memory.dmpFilesize
1.1MB
-
memory/2964-1-0x00000000001C0000-0x00000000001C3000-memory.dmpFilesize
12KB