95f37cd6baea78261cd24809424fbd4d774690d905e93bdb42c9323a44e14d98

General

Target

949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
Size

128KB
MD5

949fa58a792c094e3221a22cab112a46
SHA1

3baf17909dd1f7ce249b33fbba64f0c31f2d938f
SHA256

95f37cd6baea78261cd24809424fbd4d774690d905e93bdb42c9323a44e14d98
SHA512

73a3baf20c204aba7871f6486068d04e11898f1e47b44a4f95dde710796df68f580c88c8cc131953423723ccdb29c0a5cb1e816d5faeffa808ff3b9876bffe8d
SSDEEP

3072:uKXR/jtaBnpdnc8pxK30Tc/1BuP8vxV4PJSwJm2S6tow1uIR:uKBBMnpO32YpJXwJm21om

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2464 set thread context of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 3236 set thread context of 376	3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
376	svchost.exe
376	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 2464 wrote to memory of 3236	2464	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	91
PID 3236 wrote to memory of 376	3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	92
PID 3236 wrote to memory of 376	3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	92
PID 3236 wrote to memory of 376	3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	92
PID 3236 wrote to memory of 376	3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	92
PID 3236 wrote to memory of 376	3236	949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe	92
PID 376 wrote to memory of 1000	376	svchost.exe	93
PID 376 wrote to memory of 1000	376	svchost.exe	93
PID 376 wrote to memory of 1000	376	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Checks BIOS information in registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c for /l %i in (1, 1, 4000000000) do if not exist "C:\Users\Admin\AppData\Local\Temp\949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe" (exit) else (del /f "C:\Users\Admin\AppData\Local\Temp\949fa58a792c094e3221a22cab112a46_JaffaCakes118.exe")
      4⤵
      System Location Discovery: System Language Discovery
      PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/376-11-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/376-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/376-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2464-0-0x0000000002180000-0x0000000002196000-memory.dmp

Filesize
88KB

Download
memory/2464-2-0x0000000002180000-0x0000000002196000-memory.dmp

Filesize
88KB

Download
memory/2464-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3236-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3236-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3236-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3236-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing