d785ad7a069cea67dee93a7ce197f1925ec1840ec944e1eb5bcef706170bc593

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Size

552KB
MD5

18e06fd132daec93dde2fc709a0e92a7
SHA1

53c3db9a6d5dcb174001bf7c6530d27620dc0b25
SHA256

d785ad7a069cea67dee93a7ce197f1925ec1840ec944e1eb5bcef706170bc593
SHA512

38d111a1e5ec1bb28b00abfb23a685242d5c238ed8548857c883f2db9c1ed0674dc636b77640ef17c5b982f45e9de61a468cb659f55442994f058dfdbbb73e19
SSDEEP

12288:db7GdkHvl9P2zVt/A6LSAAhx7Z4J51NNzJmPabdQNED+YnsdFtxDkzXr:0kHN9P2z6bGT9CaSxYnsdWzX

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\InprocServer32\ThreadingModel = "Free"	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\VersionIndependentProgID	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\ = "ModemActivation Class"	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\InprocServer32	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\InprocServer32\ = "%SystemRoot%\\SysWow64\\sppcomapi.dll"	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\TypeLib\ = "{B0C2A63F-AFF8-40E3-B42D-8A542DC909EC}"	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\VersionIndependentProgID\ = "SppComApi.ModemActivation"	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\AppID = "{6D9A7A40-DDCA-414E-B48E-DFB032C03C1B}"	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\ProgID	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\ProgID\ = "SppComApi.ModemActivation.1"	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBF4B8FC-BBF4-B8FC-BBF4-B8FCBBF4B8FC}\TypeLib	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2184	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2184	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2184	18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18e06fd132daec93dde2fc709a0e92a7_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-15-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2184-13-0x0000000001E50000-0x0000000001EA6000-memory.dmp

Filesize
344KB

Download
memory/2184-10-0x0000000001E50000-0x0000000001EA6000-memory.dmp

Filesize
344KB

Download
memory/2184-9-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2184-8-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2184-7-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2184-6-0x0000000001E50000-0x0000000001EA6000-memory.dmp

Filesize
344KB

Download
memory/2184-1-0x0000000001E50000-0x0000000001EA6000-memory.dmp

Filesize
344KB

Download
memory/2184-0-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download