Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/09/2024, 05:00
General
-
Target
e1bf7a67e97906838d9aa160eee326d5_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
e1bf7a67e97906838d9aa160eee326d5
-
SHA1
b1e2e432c61e43601a10492297041200581f54c4
-
SHA256
c8f4c11aa398ac03baf97205fc40bf4bf626b55421e678d38c3ee9ea35b07182
-
SHA512
23aa1da64fc40ab3954488061585f17450bd6b7034d9bf4244c7db98dd03b780919f3b761d703eee46dca1d551b25b8cdfa97f740308c82c455a19af2136554f
-
SSDEEP
24576:djo1MCIJH6m0hl9lUtwCrOqjJHlSXHrfyU:a1MXanetbiSHQXG
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 20 IoCs
-
Loads dropped DLL 21 IoCs
-
Drops file in System32 directory 22 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
NTFS ADS 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1bf7a67e97906838d9aa160eee326d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e1bf7a67e97906838d9aa160eee326d5_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1bf7a67e97906838d9aa160eee326d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e1bf7a67e97906838d9aa160eee326d5_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 460 "C:\Users\Admin\AppData\Local\Temp\e1bf7a67e97906838d9aa160eee326d5_JaffaCakes118.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 528 "C:\Windows\SysWOW64\nod23krn.exe"7⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"11⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"13⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"15⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"17⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"19⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\nod23krn.exeC:\Windows\system32\nod23krn.exe 524 "C:\Windows\SysWOW64\nod23krn.exe"21⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\nod23krn.exe"C:\Windows\SysWOW64\nod23krn.exe"22⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110B
MD5b39cf43b74e3238e4949ccdc6831c6c3
SHA1163bc2da284a51856a648254222188fe28975233
SHA25605f3e6a3b6bc890325ea2f7368fb412c6c63dec75e3612e99e2e99b775c27c0e
SHA5122f8980e099b9959ddfb258bf54dbf75644894c7766ea2fa4bf59ff56e54ce5e92f897f8d9983731a9511bf597fad5a89bd2788b1dd9908f0abb696d9c10ec3bc
-
Filesize
110B
MD5c0a1f5e606310903ed400177f0baf8ee
SHA1a487e1cdec129113ba5c41816a4b157ccaae761f
SHA2560295cfa5ec6601eee80ba9a0a0a721d5b72dbdd089ea43275572ad724748ab78
SHA512563295094092d97c4d0996fa0b90cd44955c151e50c520908f19e45a45c7d79790c1445f8e8ba631e3277a8fe6fccb1c6b94f2211f9bd22dace84d1e98072918
-
Filesize
110B
MD5d28d00f0221f73f7515a2d8dfbdd4544
SHA164680b5b5ea9c2f30854233966a7deb8f89bb0d4
SHA2560700ac77320dd0328a8277404266b2f43ded61796e3c402a11477fbf9c37f55a
SHA51251c6d9ab9c724d6387ca98b99e95052eac23d4a4e979a923870aaa0ad96ef00b056d96260fa0c8815f5abd74fd7a3eb640421ad44060cadeffa0b344a2db3c1f
-
Filesize
110B
MD556a041f712f39bf51c8e2d19505e6c8c
SHA178467e23338920d3558d858db27ccfa49beff204
SHA2564e9857da080c180712bfd897e7e509bbf08cdcbfd37ba87624c2ee606af28ab0
SHA512c07baf818067ccb065595008c774dd77518d224d856891a8546c41a34e25edd3e01f6a4d754013d49ac1c1778807f0858abf5f892d6940a0985ba0303f938b8a
-
Filesize
110B
MD510ce5edd00aa396f05e65d38a737dc50
SHA1cd7ae61021a5084762c7cbc179998b2d9711c92b
SHA25625c3330aea82b91145726eb9bb75fde46a8d187597539067ef7c9a03fc691b6c
SHA5127c075fef2a1fe1fbbb1a04ed1734b09dba96522ad58e936de9e746fa59040c9f3af1f2a51c32c00f5150685cb764dbc57779a8b3a7ea97346405ac8b1e3eebd0
-
Filesize
110B
MD5578e47643b9c7c8d95e5b7437200290a
SHA18ede476bb04556bb04e81520eee7afcd0981bae9
SHA2566ca2933dac6c3f67df8f58b942053752ebb2da845779f4b57dedc99b837c4b5b
SHA5126d011e721bdb6e110ab0c61d76dcaa1cfe0346649dcdb44690f77b7ba5060df8e69d901b6c38ae59b93ec9d34427593185902476b439cc1e0d63331757c3c4b9
-
Filesize
110B
MD5e413e3c59d4ad397a6de9b27b28c502d
SHA140adbf4473bb279d9ddb3a85ca6883e2fb4d3adb
SHA2566dbc8feab4c5b4a3201bccd04a7efec7cc38560c30aa2e035da5cd8e90406ced
SHA512dfa7da1fe77444059b3ee6e52f2e884e2628267cd34b98f3a63a6aab64a77d4bb6d3ab6e527f2db6124abc4f8e14ddfadc537622610ec2fd9f97961b67c5c19b
-
Filesize
110B
MD5c5f44d01941da77d241128c93f66a274
SHA12c147f9d42b51a101c7f023454f24d5e1258ebd3
SHA25614528502a4301b27caccb17ff7e3e1467e8a9237719199904e7fc2a696186a8d
SHA512c8d348a074b6e2b7f1685e4a065809864d8890dda16371f2eed7ea6090a2e8020d3e3343abd2a5c7ad6196a01eff902bf99c4c19e743ef21449462762145d624
-
Filesize
110B
MD5f8c0bea82f2a97fea31bbb2d0d1a7b02
SHA1d0293170838a561317dbb5095bf46732856d4fe9
SHA2565f877bbf7750385c085e16b6bb93ef1412379ec9a15236e4f843a20f7020428a
SHA512d3bdca63ddf2dfcade1adae30588d4e4211e87105f645f683d56ac83a83e557a39e46cf3cced027ea0746e152388140ed63505bba20a40b31d038ed692db1c36
-
Filesize
1.0MB
MD5e1bf7a67e97906838d9aa160eee326d5
SHA1b1e2e432c61e43601a10492297041200581f54c4
SHA256c8f4c11aa398ac03baf97205fc40bf4bf626b55421e678d38c3ee9ea35b07182
SHA51223aa1da64fc40ab3954488061585f17450bd6b7034d9bf4244c7db98dd03b780919f3b761d703eee46dca1d551b25b8cdfa97f740308c82c455a19af2136554f
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
548KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
548KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
548KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
548KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
696KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
1.2MB