a80a01c26b117d0481e5a271c8e449a19b6e127cc4d40b2692c2f01e798c6dd2

General

Target

8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Size

948KB
MD5

8bfb6e867ecd0bf4e8ffa8f53fb9412b
SHA1

3c1e171600e37e0c412e09221182a20f217dd6f0
SHA256

a80a01c26b117d0481e5a271c8e449a19b6e127cc4d40b2692c2f01e798c6dd2
SHA512

0ea5e22b6c32e0dd0a8abec44f5e812b83c5b4533b7855e3d5cdbb27bf0847269bce902a34840ecda949b919169393c3270f1dc4cd2bb94da4e9424b8bf1b3ae
SSDEEP

12288:7qmpplpGoGL3etQoMiXM8gxf/Sj4yToPwUDfW35/awKh/wL5/uK3aK4UKCZf38+N:T563ey8gZqj4yToPlv2V/DK7UKMkkeC

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI4	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}\ = b626beec291b5f4dc9273cd1e80899400c6c06841ec376425074c2dc4b373d61d70b3125a7cf6e6626f09e93487d2497e241cb1f82b63c9014bd02e880e435632fed19a7b4beeed7b901afc3669d800853e40db3e75d014bef0599a34c7aa4551fcfc926a3211a93cc4aa5451cc37632e0d459bf73161d304b2ea5b8cf1586c3fe8a17023e1aa8ca7fe229bd8728ee78782ceadadd4b4825a6138f45f9af68465c40081886b3b1e5d76c4ea4584f36396ed3a6ca8f4426bca1546f3219d4770da1e7bf8e16787e6ed6f83f1216ccbe5b17f5019c1c8948db5ecac92427ae014790d1c0f05ba3ca5d9cf7b5a19c68087dc617d1b173535d3d0beba51a7cf2146d8cfbf9ad57b881d190ff3256aabe7dd62b819d434b8d3dc7eb9eda764dee87864e51e74cb1c4a0ff9f96c93e18e8369a5e75b660effa9913b00aabba7d55977041de33f7edaec4064f3e99e848c23efd9654cf82b96550138885c5909fb776e19014c5c09fa576139e05f7df9109b05f5249c4e3af52f9325424ff5ce98a9c63092d3f4729815b644d70871c0e4af87c51a83346156e7318ad8864fb52ad7278e4e8ff83a94564b3a265eb3fa596b0c0914f07e691e07453eec5e793ee42f96d170781a1004b2c1d78f7d72ec1d8b8b115183f4c6926d8fecc579b017b5edbdb079f35a4bdceca6ecb05dedb7e76dc8ea7a8a0c1746e4fc07baf138a287bbce822ea3cc2e5b74c8c4524aacc35f3d5ac	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{FE93F2CD-289BDC02-D6082ECF}	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{FE93F2CD-289BDC02-D6082ECF}\ = "2575681456"	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}\ = b626beec291b5f4dc9273cd1e80899400c6c06841ec376425074c2dc4b373d61d70b3125a7cf6e6626f09e93487d2497e241cb1f82b63c9014bd02e880e435639f2a9c3eb4beeed7b901afc3669d800853e40db3e75d014bef0599a34c7aa4551fcfc926a3211a93cc4aa5451cc37632e0d459bf73161d304b2ea5b8cf1586c3fe8a17023e1aa8ca7fe229bd8728ee78782ceadadd4b4825a6138f45f9af68465c40081886b3b1e5d76c4ea4584f36396ed3a6ca8f4426bca1546f3219d4770da1e7bf8e16787e6ed6f83f1216ccbe5b17f5019c1c8948db5ecac92427ae014790d1c0f05ba3ca5d9cf7b5a19c68087dc617d1b173535d3d0beba51a7cf2146d8cfbf9ad57b881d190ff3256aabe7dd62b819d434b8d3dc7eb9eda764dee87864e51e74cb1c4a0ff9f96c93e18e8369a5e75b660effa9913b00aabba7d55977041de33f7edaec4064f3e99e848c23efd9654cf82b96550138885c5909fb776e19014c5c09fa576139e05f7df9109b05f5249c4e3af52f9325424ff5ce98a9c63092d3f4729815b644d70871c0e4af87c51a83346156e7318ad8864fb52ad7278e4e8ff83a94564b3a265eb3fa596b0c0914f07e691e07453eec5e793ee42f96d170781a1004b2c1d78f7d72ec1d8b8b115183f4c6926d8fecc579b017b5edbdb079f35a4bdceca6ecb05dedb7e76dc8ea7a8a0c1746e4fc07baf138a287bbce822ea3cc2e5b74c8c4524aaccb92d76ba	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{1D82E22D-6CE037F1-6A19C286-FFBF34BF}\ = b626beec291b5f4dc9273cd1e80899400c6c06841ec376425074c2dc4b373d61d70b3125a7cf6e6626f09e93487d2497e241cb1f82b63c904a00422487e435632fed19a7b4beeed7b901afc3669d800853e40db3e75d014bef0599a34c7aa4551fcfc926a3211a93cc4aa5451cc37632e0d459bf73161d304b2ea5b8cf1586c3fe8a17023e1aa8ca7fe229bd8728ee78782ceadadd4b4825a6138f45f9af68465c40081886b3b1e5d76c4ea4584f36396ed3a6ca8f4426bca1546f3219d4770da1e7bf8e16787e6ed6f83f1216ccbe5b17f5019c1c8948db5ecac92427ae014790d1c0f05ba3ca5d9cf7b5a19c68087dc617d1b173535d3d0beba51a7cf2146d8cfbf9ad57b881d190ff3256aabe7dd62b819d434b8d3dc7eb9eda764dee87864e51e74cb1c4a0ff9f96c93e18e8369a5e75b660effa9913b00aabba7d55977041de33f7edaec4064f3e99e848c23efd9654cf82b96550138885c5909fb776e19014c5c09fa576139e05f7df9109b05f5249c4e3af52f9325424ff5ce98a9c63092d3f4729815b644d70871c0e4af87c51a83346156e7318ad8864fb52ad7278e4e8ff83a94564b3a265eb3fa596b0c0914f07e691e07453eec5e793ee42f96d170781a1004b2c1d78f7d72ec1d8b8b115183f4c6926d8fecc579b017b5edbdb079f35a4bdceca6ecb05dedb7e76dc8ea7a8a0c1746e4fc07baf138a287bbce822ea3cc2e5b74c8c4524aaccd9a74f31	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4148	2012	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	87
PID 2012 wrote to memory of 4148	2012	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	87
PID 2012 wrote to memory of 4148	2012	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	87
PID 2012 wrote to memory of 4148	2012	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	87
PID 2012 wrote to memory of 4148	2012	8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8bfb6e867ecd0bf4e8ffa8f53fb9412b_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/2012-2-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/2012-14-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/2012-15-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/4148-12-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/4148-17-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/4148-16-0x0000000000790000-0x00000000007A4000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads