Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26/08/2024, 07:57
General
-
Target
c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe
-
Size
668KB
-
MD5
c2953e3efeb5e40d514e6b9b77172c80
-
SHA1
89564191bc6b4fe1c6336fdaf9088a5f14727d08
-
SHA256
64d52e0c184cb3db319bfd9c5b52d88021b0f98e3da163d467505b37e719605f
-
SHA512
660d4e6fe8b9d4fbdf161bcb3272f98e17ea9b6b69cd9168a701feeaa6a68829ed5a2a710c357f392a3a4f2f4ae94638db05a6b17c7e2a999f8bd9aade776857
-
SSDEEP
12288:kw1x9pq1SvKxYxMgv0sz001741PymqzV/GwcLQo3wk/LJKCGtqA8Vu8NzWsy:kw1x9pq1SvKxYxMW0sn1E1Prqp/GwaQf
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 16 IoCs
-
Drops file in System32 directory 18 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
NTFS ADS 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 800 "C:\Users\Admin\AppData\Local\Temp\c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 792 "C:\Windows\SysWOW64\.txt"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 732 "C:\Windows\SysWOW64\.txt"4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 744 "C:\Windows\SysWOW64\.txt"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 752 "C:\Windows\SysWOW64\.txt"6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 712 "C:\Windows\SysWOW64\.txt"7⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 748 "C:\Windows\SysWOW64\.txt"8⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 756 "C:\Windows\SysWOW64\.txt"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD5483957f5d745f444539ee1e2065aecc9
SHA159ba4e7227d7b93c2a9e18bc150fbdf20538980d
SHA25639b0f9bb34689d93f736dcc1831233139401f9e50184af550d82c8da5f5dc647
SHA51254a40d60c5e6334e9c67c8660b904cf424d31b10c6475a4f18e9f8feb04dccdd2009ca9ab9f96713f8963efc8822b2d74e6f5d4037c17ef59c16b0ec8800d31e
-
Filesize
120B
MD58ef91dfc912eb8257c0d2b6e3c1b837b
SHA14754f5d510f60b06933e96e13b6a565bf4552476
SHA256ca64673218e704421f01ac42fc717848bd78a10745572cfb1e7f6af182754494
SHA51290d66fa3bf923ab772aec358f5cea41f7989d18c0db44b45b1a4ab542253a093d58ea12710271264cc20b4a5cb4c5199e9ec30c7cae58f7fec56e55ff9222140
-
Filesize
120B
MD5e8d86c8a64ac6b1ee6f0434a7bdbd3fc
SHA1d0cd8d2ec04a35c8fee05c2b7a1dd6d20a6fd680
SHA2562378828d75d024cb0fc07d2d4e7930763d498527087e90cd4cde158bfecd2597
SHA512378c2eeee5f2c9560defca57a486e15208d5552a3fae7c68a021831f16e4032e3a5e89a2a81b078c2603ab4c61344b0edce21064f5f8eafff8eeb33efcdfaf55
-
Filesize
120B
MD55bba62694c0f609ae90d9fb845e97952
SHA18376c1fceff0e2456fcc9f26f4000cef613c5ba6
SHA256897002bc8026b9c977506c54231549ea75b102084082cd56bf2587999c45de3a
SHA5121820d03fb79f5814366b3629574ca6a5acfc79b3bcede732fd440cbd4094cc2c039b4167355a7d325e204effe6c6a78995daa092cad8e18a959b5192e9aef7be
-
Filesize
120B
MD57a3b0c2df05c67f23a96ff4619f0e285
SHA189650d4e25b1491036a33dbf42291c131524caff
SHA256b1850336663d266f4df177eb15f1032685e84490f6fdae932c5bb5ab593a05ac
SHA512c134d3f83f9e646f70cdc7f2fa33b761068187bfcf5db8b4620fa1085a47b9d0a11d08339f5912e0a4f2e8210d867c253bfbf714434dabec08a4f89fbfc8f5ce
-
Filesize
120B
MD51b2fa1feecc76acb8a61eb34280f2bff
SHA13ce1c70bbdbe79ce7c0edfcbe324a12680e57c69
SHA2562b86c9a8818c025042389cc65343f621601b4ddc17e3c1add2ba93d48d6a8b20
SHA51286d2075eb060103331ab65ec47f37ae45687b0b87d511ee7cf77506562923c244249adf812772b4af20c693d222852f98898b4f0e8b3610a4cc0369ce76e27e0
-
Filesize
120B
MD505e6eeed6aa7ff0bc3263802b272cc66
SHA1cd01396921a618bdbcf08cee8a33fcbd0a279c67
SHA256faae9422965981b5ca582967b24b240484f0ca4798f68c8457a9ee6ac73f7e23
SHA512d18b2133cc012108b601c119b29421b5caf434266137cbb545c425f60536854335783dc11bbbd43e05ca963542b7414ba33adadd6b10638e303294e89d8f6785
-
Filesize
120B
MD5884258a12a74c11c6fcbd6c0101d0148
SHA131eb6e5de1325c108ed1de625db8ed8f67ac9974
SHA256d70bebb310b57f016ca3f49a17d4b07fcc52f7e9b7f82ea036751a6b1ffc9201
SHA512a63b68ff46ebf945819e4b9ce465802c34120e3d09b59d0329286b934adc87b5fd359ef683478fdf085ef5bf7bb4e2038401aaa092330356cbd85147c10bd0d0
-
Filesize
120B
MD574ba7396f325535b0fad66c153866f98
SHA11287c3ad7336028c16ae36ccfb822211b33aca26
SHA2569481dac3ad65214b1063bacd621c5e67401a3b84cca8190caaa754ee77a0474f
SHA512a8fbcf9ecabfd16ce501e5af9bbc6ff47ece7be7749d8344901b7cb9e531c6f9c5af9fae9674d0c795c4241080547d1bbc3b5738c711d1768401d2dbdb2c7c38
-
Filesize
120B
MD5e71e62b0ae93ce14eb5718c140961116
SHA15db9b1aacf1cadf9b58de4db6adcfe852a7c3884
SHA25663bbe7e9e652779372dd12cdc03352e1f41fa13eff7c312b9b368363913083c6
SHA5129f9460010944a22dba5b16547d83b10c7a8b59820109334905c1f4fad6285bd53d3dfb9ee2f4b46d26a454d157fcea17a51a945e5ae89407b9444117d6816e38
-
Filesize
120B
MD5cc44770a5cae6ea032fa496f5aa6db6d
SHA10d4739bc4f5b74c81771d8fdbd1c2754cedfb229
SHA2562412a74a0c0ace4858330e52a9676fc5e76ed287da2aaedd5fe52ca9ff656f7b
SHA51223864de02454c787437772db25ae31b6dd0c285aaca3f851f2a615bad2f0b2afa9fa194b1b13b1877f6b4a3db32f7855c1f2a4c5ce2ba5b867f2bb4bf10600c3
-
Filesize
120B
MD522e02217543afdf520211b99b969ada2
SHA161ec030532b2a81ac7bae05965c89c6be241dc23
SHA2563063fb0a04147220a733d2daa0582b993409136f335f44ee75b616dcf869b257
SHA512c1116dcd2a0cebcbd5cb856fe84161e6c40746761a4f40f5288c4a8de21e08667b672f6918d9a7ad43642eec87a5e7899666ff1bd01c85f13d25d3829849fe03
-
Filesize
120B
MD5715461b50e27922a81cd13402de29ba4
SHA1feaa7ee37ff612e3df32b35a4502ebc25baab171
SHA2562429751f466cf623687db4a234f39baf325a6a7492d5a2196ded5b136e542797
SHA5120c68c334294568be81f6ad64415ac316aa2c71af5e52ed618f23c178a037cd2b6811a67f5e7eb1e8a43f3d5612a35da8443ce65199a5c10e64e6a79a87e33942
-
Filesize
120B
MD5c1a9ac9253e3d17774ab3412ff400af1
SHA14b89e3790d9410ed93441dd0b7ce33f922abb234
SHA25692570c9a75b0e1b87658e9ae83a723a3565c86b6adf85cb0be03b6c01b867a26
SHA5120ea2d21dc0ed5c2d965acf4b35a8301a9661b73d616b20cffd7bbd95b5249270d46c490d18979c2580163a371e7d0997bfc2547ff06ceb0aa979d5623c5e9812
-
Filesize
120B
MD5065a77488b1645176e69537c3e22589b
SHA17fcaf065ae1dfa8e9b0650372707fb661f541c94
SHA2561310fecf25b3b756c42e398d86cebcb9064a8ee8aadf1173a34a96058e0e76b6
SHA512462959f0c489e8551c55df36952ec2f265cc7fd71f256db6af8b69bfaa03afa5434542ed0accbf99007e2ef7db2da868c9fd2099f3e6a73baf6cec89f09ac723
-
Filesize
120B
MD5fb0d8398e4ca6abcc88579b83c03376a
SHA1823c9032c4cc900276226dc191fe399ef360ee88
SHA256ee22dbd5659bef3dd647f523bd6f4f93874e6e51bd1df98ed101d17e3d2493de
SHA51236ce38bdd3687b4b525f23db4755c4cc35cb8fdeae0f37dc114d66e411a9729948a39b822a994351ca1c86b8342455c1ecd5b3286f7adb34709cfc95c1903cc4
-
Filesize
668KB
MD5c2953e3efeb5e40d514e6b9b77172c80
SHA189564191bc6b4fe1c6336fdaf9088a5f14727d08
SHA25664d52e0c184cb3db319bfd9c5b52d88021b0f98e3da163d467505b37e719605f
SHA512660d4e6fe8b9d4fbdf161bcb3272f98e17ea9b6b69cd9168a701feeaa6a68829ed5a2a710c357f392a3a4f2f4ae94638db05a6b17c7e2a999f8bd9aade776857
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB