15248611bb13ad117b920beab27b4127548d507a404a221db8cdb6f48245c852

General

Target

8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe
Size

812KB
MD5

8d6e16652255248faf57ad57c890c36d
SHA1

4403ef0c6b8ca2f0d66a5d1ab8fab014bc6d7a74
SHA256

15248611bb13ad117b920beab27b4127548d507a404a221db8cdb6f48245c852
SHA512

668965db931da5c620ac59b84b79d70edb04af7df09bee95147b8b350bc11992686a3f7c34747b68a714826b10ff49a27fa23098df4441975ae85859debda5e0
SSDEEP

24576:g8QT6rzvo4ZD1yiQQNN3iR1n7HNhf1zRZ27n0:R5AQH817HNhvSn

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF76B5A2-CA3A-E66F-A851-28D5F2D1CFEC}	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3028	3032	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3028	3032	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3028	3032	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3028	3032	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3028	3032	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe	30
PID 3032 wrote to memory of 3028	3032	8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe"
  2⤵
  - Checks BIOS information in registry
  - Modifies registry class
  PID:3028
- - C:\Windows\SysWOW64\taskmngr.exe
    C:\Windows\system32\taskmngr.exe 724 "C:\Users\Admin\AppData\Local\Temp\8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe"
    3⤵
    PID:2536
  - - C:\Windows\SysWOW64\taskmngr.exe
      C:\Windows\system32\taskmngr.exe 724 "C:\Users\Admin\AppData\Local\Temp\8d6e16652255248faf57ad57c890c36d_JaffaCakes118.exe"
      4⤵
      PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\taskmngr.exe

Filesize
812KB

MD5
8d6e16652255248faf57ad57c890c36d

SHA1
4403ef0c6b8ca2f0d66a5d1ab8fab014bc6d7a74

SHA256
15248611bb13ad117b920beab27b4127548d507a404a221db8cdb6f48245c852

SHA512
668965db931da5c620ac59b84b79d70edb04af7df09bee95147b8b350bc11992686a3f7c34747b68a714826b10ff49a27fa23098df4441975ae85859debda5e0

Download Submit
memory/2536-31-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2536-32-0x0000000001E00000-0x0000000001F9C000-memory.dmp

Filesize
1.6MB

Download
memory/2596-34-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-11-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-3-0x00000000004E4000-0x00000000004E5000-memory.dmp

Filesize
4KB

Download
memory/3028-12-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-13-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-35-0x0000000000340000-0x00000000003D5000-memory.dmp

Filesize
596KB

Download
memory/3028-10-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-14-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-15-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-16-0x0000000000340000-0x00000000003D5000-memory.dmp

Filesize
596KB

Download
memory/3028-4-0x0000000000340000-0x00000000003D5000-memory.dmp

Filesize
596KB

Download
memory/3028-9-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3028-30-0x0000000003010000-0x00000000031AC000-memory.dmp

Filesize
1.6MB

Download
memory/3028-2-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/3032-1-0x0000000001F70000-0x000000000210C000-memory.dmp

Filesize
1.6MB

Download
memory/3032-0-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing