Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 11:34
General
-
Target
aad91b80b63a0cb9307e981a566370ea_JaffaCakes118.exe
-
Size
760KB
-
MD5
aad91b80b63a0cb9307e981a566370ea
-
SHA1
6e9e741b70639207f598248e1563be40ddcf9b33
-
SHA256
81966a79010fb798795b7e255f14bedf00a2c94899fb30c29d4739590732cb9f
-
SHA512
5a0c05fa3201ff7a054a161aac0828267ffc3be730cb662fee88e9e52c6802f3218351b450bb3881f915c21070f7371b8751c564c21dd1d9f312f53e8bb22b5d
-
SSDEEP
12288:8Iyv5dgpTH+ESb2os6HnOPo0VdfG1mIn0sSelRnlUZrHQcyDBCZfv:8Iyv5dgpTH+ESios6WJH6m0hl9lUtwzO
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 8 IoCs
-
Drops file in System32 directory 18 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
NTFS ADS 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad91b80b63a0cb9307e981a566370ea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aad91b80b63a0cb9307e981a566370ea_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1520 "C:\Users\Admin\AppData\Local\Temp\aad91b80b63a0cb9307e981a566370ea_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1516 "C:\Windows\SysWOW64\mirc.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1492 "C:\Windows\SysWOW64\mirc.exe"4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1528 "C:\Windows\SysWOW64\mirc.exe"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1540 "C:\Windows\SysWOW64\mirc.exe"6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1536 "C:\Windows\SysWOW64\mirc.exe"7⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1508 "C:\Windows\SysWOW64\mirc.exe"8⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mirc.exeC:\Windows\system32\mirc.exe 1548 "C:\Windows\SysWOW64\mirc.exe"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD50961346c4aa82872414779a9538ba407
SHA10367bd3e6fd72e65b270429555df75d9af8c9a78
SHA2564be1555253980b941a3332506fb0915b832149af80d1acdbbec41a4e3e0fd1dc
SHA512cef28df5e3b31a0eaf27cd6fbafe530debbc2c38140fdaf166767d6c01720bdbf729f85169b445d83d91acb2bbc66a4c678a1b6548797ee2b7b7c987507aebb4
-
Filesize
120B
MD504ebf794aaccf17726f639e9d4d2c994
SHA186e3e6548a050fb3eb29ffc4457c8c8f327b0b2c
SHA256c909b140d12080b160a7f946817565b8e4b1692fff5063a574ebd6ef6c8362ef
SHA512ad012921edadeb9bd3708c46240d6e1ed26f411910fe54b06d03d62d8b7251e52e857735a29b4efd53cb211227737090d6c3f1b701e1e3dacdcdb8f286fed45f
-
Filesize
120B
MD506cab684a75bae697cee4aa749ea8d54
SHA1f57bd075b370933210fe12a74c18771bd6b1771f
SHA2560c60609c47bd5f8dc20e74b6bb13d78dd1becd7f05619ba5aecc918fa10c1dfa
SHA512fd1966d391fdd05ca5191ae80c7c95334cddb3d546949322fb48ba0bc69f4010365d8138ba62cebd5dce6f8a7d747751c95ea2e42cf1d7e0c5b5fa33ed633b95
-
Filesize
120B
MD5c9a9ce26b0d9d457dd5da8ffc6db6b03
SHA10482da6c9e718e412fd67a5ec2dfb92c150b2571
SHA256957c712f8e6e32734bbab699288199ca4fb304b7b1fa562b0cfff5b90de07e7a
SHA512f968ef3b05f0e0ba7b8bb3e9d8bc234bbebbb4f11c900e9942973b31edca659cb17a8e1d12b2d5ee4b8d547268b8c729bd0da16c9b672a08718220426689ceaa
-
Filesize
120B
MD54cdabead0fb3c05f441e955e0133e525
SHA13b103c74ee0451aebfc118bb1973e17f0e9e529e
SHA2567ac4131b42fc0a03f806bcef5242781dd105a6bcaacc42f06731b3401c71e858
SHA512d4007ecb2551cf6a2aca6f4f9977d607a871ae5cd767d8310e35b14505713854079fac066b27d02f46b3c4964ff1b432b4167695366a8ba89eeaf4b10e3bff02
-
Filesize
120B
MD575075afdb1787724209995938a2001eb
SHA1d6152009a442aec1e5d9e47cbf6506874a983585
SHA2567ad764ac615e93db69ed35fe810ee437253b1e9d84994c50ef0dfcb571365485
SHA512b95eb72b736cb9d43e9e014bf28cc79bf78e27572faee4caa0669661eeb4b75fe54ca26ec5096f5cd623ebaf9c1077a8f5c0c46938d27a0ce2f8e5feb33b6f1d
-
Filesize
120B
MD5439400c3b3ad02c2fc03ac06c2bde118
SHA117c5bf6b69eb6850ae239d0e5d79da94ca4492f4
SHA256bd30756c99228c42d5f7a369ae9b88361b827be51cc0472beb2c56cccfaf9780
SHA51244454b5d624d7ddb36782117b81d6a2e4cda7ee2e64783db109993ec4d52f2dfc5f6d95f8fb32ee1d589a41bc0920545d32447b1d85a0b2da9401e266e409449
-
Filesize
120B
MD5473b6907522572ef1b74423034803a59
SHA14001548a0c8690ba769cab1d96afca56d15f8815
SHA256e0d88220a23a2934882cfaf264c1cc4deb4d186adaf7b4194f5af3d30589ff1e
SHA5128fd9e33fffc8d1e09d8ad3b78da96fc1f6a8b97741bbd0a3191ef9fe752d21db29b17460c15968d646e551225f0c7507bee36c0ca3b70d70f1989512258e925c
-
Filesize
120B
MD552b8c406974f8d6d22fdd98f086278f4
SHA1ae1723035e085c495fcb2ac508ca182fb2fff545
SHA2562b115e3d5260a599ecc3d62c6a2bcab97949952ed0dd22e2d52a2370898c08e4
SHA512d0874d6ea836bc2a755dc83f4028ff62a75d57e6fc89a4d98991189dce0122b606217ef828bb3d108c07e5805442d02557b3c07e5116f5ba5656fd334f15e2da
-
Filesize
120B
MD591c7f0a5f9a5de95709aae97d4c6af82
SHA1f0ad6cbf485dd975ff7f7a686951fdc7ad637647
SHA256e29cc81788763341b4ca9ee79932f469945252572e03b488d5060c5297d85396
SHA5120f8bc96bcf1d5b1c76820f96250c7d6ba89db0ea3a8c64411422cb38c683f4c26993e6a08131da00de6dec797dcdc07c9b78a819ebc0888525e0b7a95681e7fd
-
Filesize
120B
MD5aef0631f46bd81c10d0f877ba451a209
SHA18f347def714996d6eba6f2440ecc4425c5ad889c
SHA2563b392be826ce8acc42b4ea6364c60255986f99dc3c2e23bd3d203be75e6260f2
SHA5121c30df0ca8343f19a2b740bd88d77fa41f76adb1f44494e80b7ce79f68ca54befb3cfd951bf5eb0531c51a573e516a4563dd00245b4e886edab2538c5b901d08
-
Filesize
120B
MD513b8e8b89a3bb4955e39ac84e135d3ef
SHA1337ae8bcbb49341e5882945cc68fea72f05fcf59
SHA256cd063eda196c8d3be3359fa95fb83bee8956baddab15e5dae75405a89d6c7562
SHA512a7839695527967cbf78d5329d012fc4dd9d88da45e2e0a2a95580e1b8dcba606653b19d7d81ad240540e00b49d94a45ca1128b740da2ad22c094523fe5b9d0ec
-
Filesize
120B
MD5e544b06d76b8b656f6297e3135eb2b03
SHA146f990a63d6d3fbfea0c121745638c9f6438a80f
SHA2566ca13e21e867bb7d3715058634b39eda780234f2e512bc7f4ef4f9913165850f
SHA51266ca169a59701dd97fbc6eae98fcd1253b7c125096e47f6c9935355b1d8ef96471415d47ec3d202466aa02c587fa03eb8caa1ee6fdbcf8bbb4e1dab9cdd80332
-
Filesize
120B
MD52d666340e68090203f768b298a20bcbb
SHA101a5f5ba4781903e8d5e45c6f138e504382602ab
SHA256fb7faedadf307c3cd9989426cb5381da7cbf697d21a4f9ff659e5f36a1672acf
SHA512be63fb7321bb9e172a0316118c8da61ce11ac5a9681ae3b937d73b56eb964205f5fb7e3a492deb8f783c6b7aa20fa39aadc1969b5b1521a1bfb56b779a7ed9dc
-
Filesize
120B
MD528e8d938cca6969d122f35090ec93a7b
SHA19e3685f9b1f9e1f772df600e13b292fb76ec9023
SHA2565b5ed3303f74e588f0e22440e3505dd5f41be6d14d50fe1ccae7a7bf7c305d67
SHA51286848a5b94b0a74610d39825a55f6a669e2acc470ebd85f8faa6008b51434acbb8715b1a54714f75f14f729174645de1764cdcf44e9bb4b45bdb27a2e02c79bf
-
Filesize
760KB
MD5aad91b80b63a0cb9307e981a566370ea
SHA16e9e741b70639207f598248e1563be40ddcf9b33
SHA25681966a79010fb798795b7e255f14bedf00a2c94899fb30c29d4739590732cb9f
SHA5125a0c05fa3201ff7a054a161aac0828267ffc3be730cb662fee88e9e52c6802f3218351b450bb3881f915c21070f7371b8751c564c21dd1d9f312f53e8bb22b5d
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB