Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-08-2024 07:57
General
-
Target
c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe
-
Size
668KB
-
MD5
c2953e3efeb5e40d514e6b9b77172c80
-
SHA1
89564191bc6b4fe1c6336fdaf9088a5f14727d08
-
SHA256
64d52e0c184cb3db319bfd9c5b52d88021b0f98e3da163d467505b37e719605f
-
SHA512
660d4e6fe8b9d4fbdf161bcb3272f98e17ea9b6b69cd9168a701feeaa6a68829ed5a2a710c357f392a3a4f2f4ae94638db05a6b17c7e2a999f8bd9aade776857
-
SSDEEP
12288:kw1x9pq1SvKxYxMgv0sz001741PymqzV/GwcLQo3wk/LJKCGtqA8Vu8NzWsy:kw1x9pq1SvKxYxMW0sn1E1Prqp/GwaQf
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 8 IoCs
-
Drops file in System32 directory 18 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
NTFS ADS 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1420 "C:\Users\Admin\AppData\Local\Temp\c2953e3efeb5e40d514e6b9b77172c80_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1532 "C:\Windows\SysWOW64\.txt"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1540 "C:\Windows\SysWOW64\.txt"4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1528 "C:\Windows\SysWOW64\.txt"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1516 "C:\Windows\SysWOW64\.txt"6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1548 "C:\Windows\SysWOW64\.txt"7⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1552 "C:\Windows\SysWOW64\.txt"8⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\.txtC:\Windows\system32\.txt 1512 "C:\Windows\SysWOW64\.txt"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD587ed3f9b54fa37e6848aead5b2bfca14
SHA195b7c98d6a661d02777da0022f58ce3fc63e5635
SHA2564b423bd38144e86c73e13c956fcd23ad019ae537211bcb49faa92957e22ddf01
SHA51248b5a8ca3bf5c5bc4462f7a79e93f09a738445de600c9bb9df6b8591c723d81c1db72067b7fa1e013206a31644b3758ac8eadb2fd86f43d20879952a9405bc03
-
Filesize
120B
MD58ef91dfc912eb8257c0d2b6e3c1b837b
SHA14754f5d510f60b06933e96e13b6a565bf4552476
SHA256ca64673218e704421f01ac42fc717848bd78a10745572cfb1e7f6af182754494
SHA51290d66fa3bf923ab772aec358f5cea41f7989d18c0db44b45b1a4ab542253a093d58ea12710271264cc20b4a5cb4c5199e9ec30c7cae58f7fec56e55ff9222140
-
Filesize
120B
MD56c008acd338f1c0d3b45ceb89312d114
SHA15d12916f3ba159659cd7a9183199d84e6e5aa5ab
SHA256010de5936305ecea731939f0532036779e0528ee78500429e4ca83427c5d39ed
SHA51275ce96f55451256c16655a46a582be23751370960349a65e6251202f8c243be824753b776f6ba5686fdf970e40b262a8d326a7a6070e3beb133252f9eec7e312
-
Filesize
120B
MD55bba62694c0f609ae90d9fb845e97952
SHA18376c1fceff0e2456fcc9f26f4000cef613c5ba6
SHA256897002bc8026b9c977506c54231549ea75b102084082cd56bf2587999c45de3a
SHA5121820d03fb79f5814366b3629574ca6a5acfc79b3bcede732fd440cbd4094cc2c039b4167355a7d325e204effe6c6a78995daa092cad8e18a959b5192e9aef7be
-
Filesize
120B
MD57a3b0c2df05c67f23a96ff4619f0e285
SHA189650d4e25b1491036a33dbf42291c131524caff
SHA256b1850336663d266f4df177eb15f1032685e84490f6fdae932c5bb5ab593a05ac
SHA512c134d3f83f9e646f70cdc7f2fa33b761068187bfcf5db8b4620fa1085a47b9d0a11d08339f5912e0a4f2e8210d867c253bfbf714434dabec08a4f89fbfc8f5ce
-
Filesize
120B
MD51b2fa1feecc76acb8a61eb34280f2bff
SHA13ce1c70bbdbe79ce7c0edfcbe324a12680e57c69
SHA2562b86c9a8818c025042389cc65343f621601b4ddc17e3c1add2ba93d48d6a8b20
SHA51286d2075eb060103331ab65ec47f37ae45687b0b87d511ee7cf77506562923c244249adf812772b4af20c693d222852f98898b4f0e8b3610a4cc0369ce76e27e0
-
Filesize
120B
MD505e6eeed6aa7ff0bc3263802b272cc66
SHA1cd01396921a618bdbcf08cee8a33fcbd0a279c67
SHA256faae9422965981b5ca582967b24b240484f0ca4798f68c8457a9ee6ac73f7e23
SHA512d18b2133cc012108b601c119b29421b5caf434266137cbb545c425f60536854335783dc11bbbd43e05ca963542b7414ba33adadd6b10638e303294e89d8f6785
-
Filesize
120B
MD5884258a12a74c11c6fcbd6c0101d0148
SHA131eb6e5de1325c108ed1de625db8ed8f67ac9974
SHA256d70bebb310b57f016ca3f49a17d4b07fcc52f7e9b7f82ea036751a6b1ffc9201
SHA512a63b68ff46ebf945819e4b9ce465802c34120e3d09b59d0329286b934adc87b5fd359ef683478fdf085ef5bf7bb4e2038401aaa092330356cbd85147c10bd0d0
-
Filesize
120B
MD53a7bdf41685b21e351e6378e4d479dad
SHA1c7aa85e9984e380c3ad62b33a59890c8368df29c
SHA256091d3c3755be3de09a8e3666e5946dce548cb7054772e301bb8ce823b47f8db7
SHA5120d58cdd2ce2f0326e7289102adaad932bce925a8e71414319bb91718d3e1425b28b574a2feb92868a8e131e00b81de0380f277cb6485df917943dfbb83e27ec9
-
Filesize
120B
MD5e71e62b0ae93ce14eb5718c140961116
SHA15db9b1aacf1cadf9b58de4db6adcfe852a7c3884
SHA25663bbe7e9e652779372dd12cdc03352e1f41fa13eff7c312b9b368363913083c6
SHA5129f9460010944a22dba5b16547d83b10c7a8b59820109334905c1f4fad6285bd53d3dfb9ee2f4b46d26a454d157fcea17a51a945e5ae89407b9444117d6816e38
-
Filesize
120B
MD5cc44770a5cae6ea032fa496f5aa6db6d
SHA10d4739bc4f5b74c81771d8fdbd1c2754cedfb229
SHA2562412a74a0c0ace4858330e52a9676fc5e76ed287da2aaedd5fe52ca9ff656f7b
SHA51223864de02454c787437772db25ae31b6dd0c285aaca3f851f2a615bad2f0b2afa9fa194b1b13b1877f6b4a3db32f7855c1f2a4c5ce2ba5b867f2bb4bf10600c3
-
Filesize
120B
MD522e02217543afdf520211b99b969ada2
SHA161ec030532b2a81ac7bae05965c89c6be241dc23
SHA2563063fb0a04147220a733d2daa0582b993409136f335f44ee75b616dcf869b257
SHA512c1116dcd2a0cebcbd5cb856fe84161e6c40746761a4f40f5288c4a8de21e08667b672f6918d9a7ad43642eec87a5e7899666ff1bd01c85f13d25d3829849fe03
-
Filesize
120B
MD5715461b50e27922a81cd13402de29ba4
SHA1feaa7ee37ff612e3df32b35a4502ebc25baab171
SHA2562429751f466cf623687db4a234f39baf325a6a7492d5a2196ded5b136e542797
SHA5120c68c334294568be81f6ad64415ac316aa2c71af5e52ed618f23c178a037cd2b6811a67f5e7eb1e8a43f3d5612a35da8443ce65199a5c10e64e6a79a87e33942
-
Filesize
120B
MD5fa00da4185e2b83c5d443ebef497c00e
SHA1e512197fb0806b4d275590e89c79443b1e516d75
SHA2569cdf65d1249ad836af090bf8b2cfb80f304635d4ba1df336478b5173eb19fc75
SHA512981baec9d92e6598d3017566f909b63d80c578455d3cfc6fd1ebb8ead5cca35d48ae7b2544fdf0a055045b8f4f4e85944a3aaf97bdde07b00f6f5d7f9b6da36a
-
Filesize
120B
MD5c1a9ac9253e3d17774ab3412ff400af1
SHA14b89e3790d9410ed93441dd0b7ce33f922abb234
SHA25692570c9a75b0e1b87658e9ae83a723a3565c86b6adf85cb0be03b6c01b867a26
SHA5120ea2d21dc0ed5c2d965acf4b35a8301a9661b73d616b20cffd7bbd95b5249270d46c490d18979c2580163a371e7d0997bfc2547ff06ceb0aa979d5623c5e9812
-
Filesize
120B
MD5fb0d8398e4ca6abcc88579b83c03376a
SHA1823c9032c4cc900276226dc191fe399ef360ee88
SHA256ee22dbd5659bef3dd647f523bd6f4f93874e6e51bd1df98ed101d17e3d2493de
SHA51236ce38bdd3687b4b525f23db4755c4cc35cb8fdeae0f37dc114d66e411a9729948a39b822a994351ca1c86b8342455c1ecd5b3286f7adb34709cfc95c1903cc4
-
Filesize
668KB
MD5c2953e3efeb5e40d514e6b9b77172c80
SHA189564191bc6b4fe1c6336fdaf9088a5f14727d08
SHA25664d52e0c184cb3db319bfd9c5b52d88021b0f98e3da163d467505b37e719605f
SHA512660d4e6fe8b9d4fbdf161bcb3272f98e17ea9b6b69cd9168a701feeaa6a68829ed5a2a710c357f392a3a4f2f4ae94638db05a6b17c7e2a999f8bd9aade776857
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
304KB
-
Filesize
1.5MB