42e34fbe1e4bc2938d44926248539fd9a00a82e7d2f29a8b936afdff82f17804

General

Target

b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Size

276KB
MD5

b0abcfe2069fa2d737bbc6dac1919b25
SHA1

36997a6160fa1855ba655288212ffe1e7aff1d1b
SHA256

42e34fbe1e4bc2938d44926248539fd9a00a82e7d2f29a8b936afdff82f17804
SHA512

9d9d1faa357b67e19347dec0365d7b941316cb0331add15ce2150aa4b4a0fe56f7c65eb6833777ad1b6fca020eb7c39c99279bfc7d4dd204aae315cdea392f92
SSDEEP

6144:xTZk9kpObgLNkxNjsLsV1lwttfwo92rkHyFe9AofqGuJZhs:xVk9jLjAs1Up69Fafq1Z+

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI4	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{2537BF67-53FC63A0-79FDE074-CE840295}\ = 0293a7abe519ab6881f988735d06ac0b633e16b3d53124c0b88230ce794274f189fc404c17bdaab380c1862f4a62f917882a9f0152b791355c44ec497164cf78c2f77ec5cdf48339518f941d562cebfd66f01bb12937380ab55f04d214d12ba8de38124bafde2212261735eab43f09b223f1168cebc35906282419a717655a58af135d9e50ac279c6a2c799d70ec839ff6ad44c34b39e6c815a6542417052ae400cb7be14e3bdd8e2c223de970b889c9877835b5f448cafeb98c30de3c52f1afc3bd8130dbf529b45806eb35c648b5ff0bf2464edbc311411430953d54335676258594b798356f88a286d79a9a106fafc29db19378618da40376e60bbac6ce0a02c1f79ff56db740c5e7272a5af92f88227931b0f03001819bc329895cbf2df27c018f34bdb870f27f784d898063620e51bd208c7be14e30bd7f70cd3103bc6e71234be60654ab29b938883545c4c74455c928bf1d8d6cc0a32b5ec66da51c286f1e82d3d9e190d39026aacb20febbf2890683e539e774e539643446384b77664ad5a1ebd7b9950f9b22ee19dd976fe5e297a85546d47baace80fcf5b23808f7e5caf7b98af0790dc8039996976ad541e7e8653db8cc8d810350b6a9fa7c8e0fe2c2e02115bbd871d5cceb9e5992a8a186401bdeee92e2a6a84a3ea7dd5f9f424f9853d8e49d188eabcd17f41fe2546ef2efbf8f42fc6b17323b9a49226a95bd54d322612666621cd3a75cc55da5fb51	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}\ = "1883825327"	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{2537BF67-53FC63A0-79FDE074-CE840295}\ = 0293a7abe519ab6881f988735d06ac0b633e16b3d53124c0b88230ce794274f189fc404c17bdaab380c1862f4a62f917882a9f0152b791355c44ec497164cf786d1336b5cdf48339518f941d562cebfd66f01bb12937380ab55f04d214d12ba8de38124bafde2212261735eab43f09b223f1168cebc35906282419a717655a58af135d9e50ac279c6a2c799d70ec839ff6ad44c34b39e6c815a6542417052ae400cb7be14e3bdd8e2c223de970b889c9877835b5f448cafeb98c30de3c52f1afc3bd8130dbf529b45806eb35c648b5ff0bf2464edbc311411430953d54335676258594b798356f88a286d79a9a106fafc29db19378618da40376e60bbac6ce0a02c1f79ff56db740c5e7272a5af92f88227931b0f03001819bc329895cbf2df27c018f34bdb870f27f784d898063620e51bd208c7be14e30bd7f70cd3103bc6e71234be60654ab29b938883545c4c74455c928bf1d8d6cc0a32b5ec66da51c286f1e82d3d9e190d39026aacb20febbf2890683e539e774e539643446384b77664ad5a1ebd7b9950f9b22ee19dd976fe5e297a85546d47baace80fcf5b23808f7e5caf7b98af0790dc8039996976ad541e7e8653db8cc8d810350b6a9fa7c8e0fe2c2e02115bbd871d5cceb9e5992a8a186401bdeee92e2a6a84a3ea7dd5f9f424f9853d8e49d188eabcd17f41fe2546ef2efbf8f42fc6b17323b9a49226a95bd54d322612666621cd3a75cc5171b6f13	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{2537BF67-53FC63A0-79FDE074-CE840295}	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{2537BF67-53FC63A0-79FDE074-CE840295}\ = 0293a7abe519ab6881f988735d06ac0b633e16b3d53124c0b88230ce794274f189fc404c17bdaab380c1862f4a62f917882a9f0152b79135cefd91f97664cf78c2f77ec5cdf48339518f941d562cebfd66f01bb12937380ab55f04d214d12ba8de38124bafde2212261735eab43f09b223f1168cebc35906282419a717655a58af135d9e50ac279c6a2c799d70ec839ff6ad44c34b39e6c815a6542417052ae400cb7be14e3bdd8e2c223de970b889c9877835b5f448cafeb98c30de3c52f1afc3bd8130dbf529b45806eb35c648b5ff0bf2464edbc311411430953d54335676258594b798356f88a286d79a9a106fafc29db19378618da40376e60bbac6ce0a02c1f79ff56db740c5e7272a5af92f88227931b0f03001819bc329895cbf2df27c018f34bdb870f27f784d898063620e51bd208c7be14e30bd7f70cd3103bc6e71234be60654ab29b938883545c4c74455c928bf1d8d6cc0a32b5ec66da51c286f1e82d3d9e190d39026aacb20febbf2890683e539e774e539643446384b77664ad5a1ebd7b9950f9b22ee19dd976fe5e297a85546d47baace80fcf5b23808f7e5caf7b98af0790dc8039996976ad541e7e8653db8cc8d810350b6a9fa7c8e0fe2c2e02115bbd871d5cceb9e5992a8a186401bdeee92e2a6a84a3ea7dd5f9f424f9853d8e49d188eabcd17f41fe2546ef2efbf8f42fc6b17323b9a49226a95bd54d322612666621cd3a75cc5ef7ecf8e	b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0abcfe2069fa2d737bbc6dac1919b25_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI4

Filesize
528B

MD5
ef50891a2a68ef8868786dd6072bdbbf

SHA1
3d2c2cea02226e0f04390133d512506132dac3de

SHA256
1020fec566d47a1c30c414a309f6d627bdfc160ebb02afd4583fa432dbb46ce7

SHA512
67616c390b585b11695da121dd29bb4034ddf7a1b27738e858309d99044cc790610ec9df6c80078bdb3f939180eed2c528993f86353c74856b197b203cb864c1

Download Submit
memory/1512-9-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1512-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1512-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1512-11-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads