b36a511d8972851037d3c8468e37868fe15ff86def42e39b6c597a76ba7071ed

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

308c613b59e76dd7b3751fa8d85c2b19_JaffaCakes118.dll
Size

1.1MB
MD5

308c613b59e76dd7b3751fa8d85c2b19
SHA1

fd4ba82f7fb47bd74d94bff5cd7a6d3f6ea743cb
SHA256

b36a511d8972851037d3c8468e37868fe15ff86def42e39b6c597a76ba7071ed
SHA512

b54a1b4e0a3d7d4e4062646c6dc8c780f0da7030ac2e5fb17c4b42682926fbc6edc9750d1e5bc535ed949ce1a7f42d40cc1e3709a44b085ac5756687752da856
SSDEEP

24576:XdSFDu0oaCO7WgFvl/m68iynYW2uPJmomQ+2JZOC0XDo:XET7RlMF9PJmo7sB

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\308c613b59e76dd7b3751fa8d85c2b19_JaffaCakes118.dll,#1
1⤵
- Checks BIOS information in registry
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3060,i,7252135083366563450,1411796122645726339,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-0-0x00007FFB147D0000-0x00007FFB14A4F000-memory.dmp

Filesize
2.5MB

Download