642e2a85e6e52292e02d56f94d2a0891b16d901af0fccfd1c66053bcde66c3e7

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe
Size

100KB
MD5

b32dc5beec05eae4dec426c3e78a6c4b
SHA1

908ee350e7eccc7252c21add8b157ea6e9f2cf47
SHA256

642e2a85e6e52292e02d56f94d2a0891b16d901af0fccfd1c66053bcde66c3e7
SHA512

b28c34180e4a5e83c340fecdcb564ed1c6a06c36b3ddc3bc0cc238d51987b712388b83175f3658dc462cbbb6cdefc569d42f3446e1fef0425d76d0f251150937
SSDEEP

1536:TP7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIfjwzsjM52G:TjFfHgTWmCRkGbKGLeNTBfjcsjY

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	reg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2424	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2504	1876	b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe	29
PID 1876 wrote to memory of 2504	1876	b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe	29
PID 1876 wrote to memory of 2504	1876	b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe	29
PID 1876 wrote to memory of 2504	1876	b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe	29
PID 2504 wrote to memory of 1720	2504	cmd.exe	30
PID 2504 wrote to memory of 1720	2504	cmd.exe	30
PID 2504 wrote to memory of 1720	2504	cmd.exe	30
PID 1720 wrote to memory of 3028	1720	cmd.exe	31
PID 1720 wrote to memory of 3028	1720	cmd.exe	31
PID 1720 wrote to memory of 3028	1720	cmd.exe	31
PID 2504 wrote to memory of 2188	2504	cmd.exe	32
PID 2504 wrote to memory of 2188	2504	cmd.exe	32
PID 2504 wrote to memory of 2188	2504	cmd.exe	32
PID 2504 wrote to memory of 2552	2504	cmd.exe	33
PID 2504 wrote to memory of 2552	2504	cmd.exe	33
PID 2504 wrote to memory of 2552	2504	cmd.exe	33
PID 2504 wrote to memory of 2556	2504	cmd.exe	34
PID 2504 wrote to memory of 2556	2504	cmd.exe	34
PID 2504 wrote to memory of 2556	2504	cmd.exe	34
PID 2504 wrote to memory of 2616	2504	cmd.exe	35
PID 2504 wrote to memory of 2616	2504	cmd.exe	35
PID 2504 wrote to memory of 2616	2504	cmd.exe	35
PID 2504 wrote to memory of 2620	2504	cmd.exe	36
PID 2504 wrote to memory of 2620	2504	cmd.exe	36
PID 2504 wrote to memory of 2620	2504	cmd.exe	36
PID 2504 wrote to memory of 2640	2504	cmd.exe	37
PID 2504 wrote to memory of 2640	2504	cmd.exe	37
PID 2504 wrote to memory of 2640	2504	cmd.exe	37
PID 2504 wrote to memory of 2684	2504	cmd.exe	38
PID 2504 wrote to memory of 2684	2504	cmd.exe	38
PID 2504 wrote to memory of 2684	2504	cmd.exe	38
PID 2504 wrote to memory of 2612	2504	cmd.exe	39
PID 2504 wrote to memory of 2612	2504	cmd.exe	39
PID 2504 wrote to memory of 2612	2504	cmd.exe	39
PID 2504 wrote to memory of 2564	2504	cmd.exe	40
PID 2504 wrote to memory of 2564	2504	cmd.exe	40
PID 2504 wrote to memory of 2564	2504	cmd.exe	40
PID 2504 wrote to memory of 2512	2504	cmd.exe	41
PID 2504 wrote to memory of 2512	2504	cmd.exe	41
PID 2504 wrote to memory of 2512	2504	cmd.exe	41
PID 2504 wrote to memory of 2872	2504	cmd.exe	42
PID 2504 wrote to memory of 2872	2504	cmd.exe	42
PID 2504 wrote to memory of 2872	2504	cmd.exe	42
PID 2504 wrote to memory of 2420	2504	cmd.exe	43
PID 2504 wrote to memory of 2420	2504	cmd.exe	43
PID 2504 wrote to memory of 2420	2504	cmd.exe	43
PID 2504 wrote to memory of 2192	2504	cmd.exe	44
PID 2504 wrote to memory of 2192	2504	cmd.exe	44
PID 2504 wrote to memory of 2192	2504	cmd.exe	44
PID 2504 wrote to memory of 2524	2504	cmd.exe	45
PID 2504 wrote to memory of 2524	2504	cmd.exe	45
PID 2504 wrote to memory of 2524	2504	cmd.exe	45
PID 2504 wrote to memory of 2700	2504	cmd.exe	46
PID 2504 wrote to memory of 2700	2504	cmd.exe	46
PID 2504 wrote to memory of 2700	2504	cmd.exe	46
PID 2504 wrote to memory of 2676	2504	cmd.exe	47
PID 2504 wrote to memory of 2676	2504	cmd.exe	47
PID 2504 wrote to memory of 2676	2504	cmd.exe	47
PID 2504 wrote to memory of 2448	2504	cmd.exe	48
PID 2504 wrote to memory of 2448	2504	cmd.exe	48
PID 2504 wrote to memory of 2448	2504	cmd.exe	48
PID 2504 wrote to memory of 2644	2504	cmd.exe	49
PID 2504 wrote to memory of 2644	2504	cmd.exe	49
PID 2504 wrote to memory of 2644	2504	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5B1B.tmp\5B1C.tmp\5B1D.bat C:\Users\Admin\AppData\Local\Temp\b32dc5beec05eae4dec426c3e78a6c4b_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\Software\Microsoft\Internet Explorer" /v svcVersion
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\Software\Microsoft\Internet Explorer" /v svcVersion
      4⤵
      PID:3028
- - C:\Windows\system32\chcp.com
    chcp 1252
    3⤵
    PID:2188
- - C:\Windows\system32\chcp.com
    chcp 850
    3⤵
    PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2556
- - C:\Windows\system32\find.exe
    find /i "Windows 95"
    3⤵
    PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2620
- - C:\Windows\system32\find.exe
    find /i "Windows 98"
    3⤵
    PID:2640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2684
- - C:\Windows\system32\find.exe
    find /i "Windows Millennium"
    3⤵
    PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2564
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 5"
    3⤵
    PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2872
- - C:\Windows\system32\find.exe
    find "XP"
    3⤵
    PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2192
- - C:\Windows\system32\find.exe
    find "2000"
    3⤵
    PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2700
- - C:\Windows\system32\find.exe
    find "NT"
    3⤵
    PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2448
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.0"
    3⤵
    PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2856
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.1"
    3⤵
    PID:2436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2716
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.2"
    3⤵
    PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2672
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 6.3"
    3⤵
    PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" VER "
    3⤵
    PID:2520
- - C:\Windows\system32\find.exe
    find "Microsoft Windows [Version 10.0"
    3⤵
    PID:1460
- - C:\Windows\system32\reg.exe
    reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    3⤵
    - Checks processor information in registry
    PID:2632
- - C:\Windows\system32\find.exe
    find /i "x86"
    3⤵
    PID:2416
- - C:\Windows\system32\PING.EXE
    ping -n 15 localhost
    3⤵
    - Runs ping.exe
    PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5B1B.tmp\5B1C.tmp\5B1D.bat

Filesize
6KB

MD5
a39d145eacdc4fcf56f43b1e636ebedb

SHA1
4c19d3d684e0196ec3e4238e7898822f9010b8f1

SHA256
49982e24bb1d13c5c862f375c97f05848728cb4e539d63f5114156aca26de00f

SHA512
ca5f14e701365772f044ee740e0d1b4f95302aa9b97b3736c0b172ee13f0c118552ae8f258f9af2e12bc31cad8e38e4dd9f4e8de59ec39a371d83ee606a4c299

Download Submit