24dc4aabb8d953c108283941ecac50af7b13008eed8f46d00f24512413ea6bc4

General

Target
a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
Size 1.3MB
Sample240613-15bdyawdml
SHA256 24dc4aabb8d953c108283941ecac50af7b13008eed8f46d00f24512413ea6bc4
MD5 a6d4990b9cc80b9becef3066c3202f6e
SHA1 132ced47fcf62507bb6d6223de0c580ee248bad2
SHA512 2b3facd0520c2695215a4a67f235f83932ec676a120d7ae2deedcfad54b08a2ccf19cc39b1c8db21b49e2ba175e2aef8528519b6a0b98a387dec769b91a59b20
SSDEEP 24576:KAAy23Cgs8SRqtgSmo64NmgDUCsLABeeUuSHUzY5IjqwI8IxOkzM:KnyUTRSnSmo6dnzieeUuSKY5Ijqj8Ixk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1200-0-0x0000000000400000-0x0000000000586000-memory.dmp	upx
behavioral2/memory/1200-5-0x0000000000400000-0x0000000000586000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5052	1176	WerFault.exe	90
60	1176	WerFault.exe	90

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1176	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
1176	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
1176	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
1176	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
1176	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 1176	1200	a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a6d4990b9cc80b9becef3066c3202f6e_JaffaCakes118.exe" Track="0001000000"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 2084
    3⤵
    - Program crash
    PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 2024
    3⤵
    - Program crash
    PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1176 -ip 1176
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1176 -ip 1176
1⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1060,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-1-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1176-2-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1176-4-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1176-6-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1176-7-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1176-8-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1176-9-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1176-10-0x0000000000500000-0x00000000005C9000-memory.dmp

Download

memory/1176-11-0x0000000000400000-0x00000000004F6000-memory.dmp

Download

memory/1200-0-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/1200-5-0x0000000000400000-0x0000000000586000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads