a80a01c26b117d0481e5a271c8e449a19b6e127cc4d40b2692c2f01e798c6dd2

General

Target

8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Size

948KB
MD5

8bfb6e867ecd0bf4e8ffa8f53fb9412b
SHA1

3c1e171600e37e0c412e09221182a20f217dd6f0
SHA256

a80a01c26b117d0481e5a271c8e449a19b6e127cc4d40b2692c2f01e798c6dd2
SHA512

0ea5e22b6c32e0dd0a8abec44f5e812b83c5b4533b7855e3d5cdbb27bf0847269bce902a34840ecda949b919169393c3270f1dc4cd2bb94da4e9424b8bf1b3ae
SSDEEP

12288:7qmpplpGoGL3etQoMiXM8gxf/Sj4yToPwUDfW35/awKh/wL5/uK3aK4UKCZf38+N:T563ey8gZqj4yToPlv2V/DK7UKMkkeC

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI4	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}\ = b626beec291b5f4dc9273cd1e80899400c6c06841ec376425074c2dc4b373d61d70b3125a7cf6e6626f09e93487d2497e241cb1f82b63c9014bd02e880e435632fed19a7b4beeed7b901afc3669d800853e40db3e75d014bef0599a34c7aa4551fcfc926a3211a93cc4aa5451cc37632e0d459bf73161d304b2ea5b8cf1586c3fe8a17023e1aa8ca7fe229bd8728ee78782ceadadd4b4825a6138f45f9af68465c40081886b3b1e5d76c4ea4584f36396ed3a6ca8f4426bca1546f3219d4770da1e7bf8e16787e6ed6f83f1216ccbe5b17f5019c1c8948db5ecac92427ae014790d1c0f05ba3ca5d9cf7b5a19c68087dc617d1b173535d3d0beba51a7cf2146d8cfbf9ad57b881d190ff3256aabe7dd62b819d434b8d3dc7eb9eda764dee87864e51e74cb1c4a0ff9f96c93e18e8369a5e75b660effa9913b00aabba7d55977041de33f7edaec4064f3e99e848c23efd9654cf82b96550138885c5909fb776e19014c5c09fa576139e05f7df9109b05f5249c4e3af52f9325424ff5ce98a9c63092d3f4729815b644d70871c0e4af87c51a83346156e7318ad8864fb52ad7278e4e8ff83a94564b3a265eb3fa596b0c0914f07e691e07453eec5e793ee42f96d170781a1004b2c1d78f7d72ec1d8b8b115183f4c6926d8fecc579b01255931db079f35a4bdceca6ecb05dedb7e76dc8ea7a8a0c1746e4fc07baf138a287bbce822ea3cc2e5b74c8c4524aacc35f367af	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{FE93F2CD-289BDC02-D6082ECF}	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{FE93F2CD-289BDC02-D6082ECF}\ = "2782894532"	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}\ = b626beec291b5f4dc9273cd1e80899400c6c06841ec376425074c2dc4b373d61d70b3125a7cf6e6626f09e93487d2497e241cb1f82b63c9014bd02e880e43563eb74c602b4beeed7b901afc3669d800853e40db3e75d014bef0599a34c7aa4551fcfc926a3211a93cc4aa5451cc37632e0d459bf73161d304b2ea5b8cf1586c3fe8a17023e1aa8ca7fe229bd8728ee78782ceadadd4b4825a6138f45f9af68465c40081886b3b1e5d76c4ea4584f36396ed3a6ca8f4426bca1546f3219d4770da1e7bf8e16787e6ed6f83f1216ccbe5b17f5019c1c8948db5ecac92427ae014790d1c0f05ba3ca5d9cf7b5a19c68087dc617d1b173535d3d0beba51a7cf2146d8cfbf9ad57b881d190ff3256aabe7dd62b819d434b8d3dc7eb9eda764dee87864e51e74cb1c4a0ff9f96c93e18e8369a5e75b660effa9913b00aabba7d55977041de33f7edaec4064f3e99e848c23efd9654cf82b96550138885c5909fb776e19014c5c09fa576139e05f7df9109b05f5249c4e3af52f9325424ff5ce98a9c63092d3f4729815b644d70871c0e4af87c51a83346156e7318ad8864fb52ad7278e4e8ff83a94564b3a265eb3fa596b0c0914f07e691e07453eec5e793ee42f96d170781a1004b2c1d78f7d72ec1d8b8b115183f4c6926d8fecc579b01255931db079f35a4bdceca6ecb05dedb7e76dc8ea7a8a0c1746e4fc07baf138a287bbce822ea3cc2e5b74c8c4524aacca4cb9dbe	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}\ = b626beec291b5f4dc9273cd1e80899400c6c06841ec376425074c2dc4b373d61d70b3125a7cf6e6626f09e93487d2497e241cb1f82b63c904a00422487e435632fed19a7b4beeed7b901afc3669d800853e40db3e75d014bef0599a34c7aa4551fcfc926a3211a93cc4aa5451cc37632e0d459bf73161d304b2ea5b8cf1586c3fe8a17023e1aa8ca7fe229bd8728ee78782ceadadd4b4825a6138f45f9af68465c40081886b3b1e5d76c4ea4584f36396ed3a6ca8f4426bca1546f3219d4770da1e7bf8e16787e6ed6f83f1216ccbe5b17f5019c1c8948db5ecac92427ae014790d1c0f05ba3ca5d9cf7b5a19c68087dc617d1b173535d3d0beba51a7cf2146d8cfbf9ad57b881d190ff3256aabe7dd62b819d434b8d3dc7eb9eda764dee87864e51e74cb1c4a0ff9f96c93e18e8369a5e75b660effa9913b00aabba7d55977041de33f7edaec4064f3e99e848c23efd9654cf82b96550138885c5909fb776e19014c5c09fa576139e05f7df9109b05f5249c4e3af52f9325424ff5ce98a9c63092d3f4729815b644d70871c0e4af87c51a83346156e7318ad8864fb52ad7278e4e8ff83a94564b3a265eb3fa596b0c0914f07e691e07453eec5e793ee42f96d170781a1004b2c1d78f7d72ec1d8b8b115183f4c6926d8fecc579b01255931db079f35a4bdceca6ecb05dedb7e76dc8ea7a8a0c1746e4fc07baf138a287bbce822ea3cc2e5b74c8c4524aaccd9a7591b	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1184	2876	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	29
PID 2876 wrote to memory of 1184	2876	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	29
PID 2876 wrote to memory of 1184	2876	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	29
PID 2876 wrote to memory of 1184	2876	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	29
PID 2876 wrote to memory of 1184	2876	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	29
PID 2876 wrote to memory of 1184	2876	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe"
  2⤵
  PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI4

Filesize
528B

MD5
a5fac12e57ffd36638b2e01d4dcf3ef7

SHA1
4023fc1e0cc93835519a66ae148e6cc3b72efe72

SHA256
13ff5b78928991eca815b43ce11891b5af715c6975d47b623a95517520254dec

SHA512
eb082159931b57f4b68b9038cab7f16bd52fd7e9353031679abcb75ed7f48dffaf952865face08d5076ae382e51e15a4d1da5ed289c6ae88d57f0c66dce73c62

Download Submit
memory/1184-14-0x0000000000270000-0x0000000000284000-memory.dmp

Filesize
80KB

Download
memory/1184-13-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/1184-10-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/2876-8-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/2876-9-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/2876-11-0x00000000027B0000-0x0000000002A68000-memory.dmp

Filesize
2.7MB

Download
memory/2876-16-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/2876-17-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads