19624e02fc560aea0aef6e392a3defcfffb9afed208babb32d009e6590f8812e

General

Target

962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe
Size

974KB
MD5

962344d5ab33f759757e3910a456fa0d
SHA1

4aa7d7c62f032368c8c41b52f0fdd04c12fd8a7f
SHA256

19624e02fc560aea0aef6e392a3defcfffb9afed208babb32d009e6590f8812e
SHA512

98989d95ed05e73c46c83deb07035e2826c69a341a85a3e0b55ccdf53a4ec0b1655b5451ebdace19fbf8549ca65b66191a11efe2d01095618c28c088266dca81
SSDEEP

24576:aJCU5JAiXLP9kxTS4JSkV26VhBvJ11BzzPDy05dNTf/4eF63iIRVOLm0b:cCAPWxO4wk8uhVJ111bDyEdNrdw3jRg/

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2296	962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2296	962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe
2296	962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe
2296	962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\962344d5ab33f759757e3910a456fa0d_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SEAAC0.tmp

Filesize
1024B

MD5
12871388b682b159ddd85545302a289d

SHA1
76b47377da188fcfddeefa0f940287f1cce9885d

SHA256
cc033f00e96cae1829e3a5c15150fe68a62f65440f1b158d9257370fbc488a9b

SHA512
d60953b62d08e52fa2860db257e2bdbaa97e7eff7007617857f7b30a76f7c7ba81f8444d313a6ad496adbbaede5af1661e72522046789bb9aee1340f7ac12c7d

Download Submit
memory/2296-528-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-0-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2296-506-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-504-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-508-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-558-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-560-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-562-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-510-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-512-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-514-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-516-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-518-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-520-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-522-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-524-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-503-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-526-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-530-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-532-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-534-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-536-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-538-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-540-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-542-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-544-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-546-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-548-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-550-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-552-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-554-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-556-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-564-0x0000000002230000-0x0000000002341000-memory.dmp

Filesize
1.1MB

Download
memory/2296-1-0x0000000077180000-0x00000000771C7000-memory.dmp

Filesize
284KB

Download
memory/2296-7782-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing