5ebca73e153270a8e71f1e516a2f8aa27e08e0870908113f974b81705fe61d56

General

Target

14eb1dd2b7eb0e1e87e44a12c9825f0b_JaffaCakes118.exe
Size

216KB
MD5

14eb1dd2b7eb0e1e87e44a12c9825f0b
SHA1

feb8c56ba1a50c0709683bc278def2a43cef0a72
SHA256

5ebca73e153270a8e71f1e516a2f8aa27e08e0870908113f974b81705fe61d56
SHA512

bc1d349d9805d2369d5564a3b426cb560d8d2c55e4994e3e0eae020ebfee53f2597b5f241147612c0ef172524ae89954d2301449b77a14aede12ac567f892ab8
SSDEEP

6144:snOls3MwasCakDx6v4k/U2b6/OAI2TzK/4:dlgBasCaQx6gk/1OoY2

Score

7^/10

persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	14eb1dd2b7eb0e1e87e44a12c9825f0b_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\72b6afd0 = "LY\tÒ\x1b\aB‰»‚¯H¶5étk(y^C†aÉÂ»Q/¦Áî·EÃ–¹×‰¬\\»µ/o²\x18\"?\x13\x10(Ð\x02‡\x1cY¦u+NròZKó‘oz*í¶\x02kšÑX¬Þ¹««\u00a0ŸwØb\x17#:—B°?\x0fŸ \x7fk³½{¿`\x1deèWã;ðÊg7›£Ð`w¥zJO\a(âK/be+ýZø\aý]\u008dÝ¯³È£/RKŠš\x12\x13\x17Š•bŠ{s²2ÿë7zOu¥}\x1d\x05xCø¯{½¥\u008d7·Hóë\x05²ç\u008f%\aÏÓ¥_·K\u008f\u00a0gûå«\"í;‹÷-è\x0få=åð\x05sz›_Õð\r£˜’\x03\aƒH\vÂs;Ç—\x13¢\x1bC\x13Å\x12—\aèÏo¨\bÒð¥8í¥š\x10Åu»\x1f\x05å"	14eb1dd2b7eb0e1e87e44a12c9825f0b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3304	14eb1dd2b7eb0e1e87e44a12c9825f0b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\14eb1dd2b7eb0e1e87e44a12c9825f0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14eb1dd2b7eb0e1e87e44a12c9825f0b_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Modifies WinLogon
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3304-0-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3304-1-0x0000000002270000-0x00000000022C2000-memory.dmp

Filesize
328KB

Download
memory/3304-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3304-3-0x0000000002A30000-0x0000000002ADA000-memory.dmp

Filesize
680KB

Download
memory/3304-4-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3304-5-0x0000000002C20000-0x0000000002CD8000-memory.dmp

Filesize
736KB

Download
memory/3304-7-0x0000000002C20000-0x0000000002CD8000-memory.dmp

Filesize
736KB

Download
memory/3304-8-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3304-50-0x0000000002C20000-0x0000000002CD8000-memory.dmp

Filesize
736KB

Download
memory/3304-49-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Filesize
4KB

Download
memory/3304-47-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/3304-46-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/3304-43-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/3304-42-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/3304-40-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/3304-39-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/3304-36-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/3304-35-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3304-33-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/3304-32-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/3304-28-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/3304-26-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/3304-25-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/3304-22-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/3304-21-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/3304-19-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Filesize
4KB

Download
memory/3304-18-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/3304-15-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Filesize
4KB

Download
memory/3304-14-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3304-12-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3304-11-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3304-10-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3304-54-0x0000000002270000-0x00000000022C2000-memory.dmp

Filesize
328KB

Download
memory/3304-55-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads