df77f23a93811be258c168169a6245c3a7c8ee7d37801b985c9e745e88f2c5fd

General

Target

1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Size

1.7MB
MD5

1709e7af5a45280e565fa95f331404b0
SHA1

e30a3c9ba1a0feb4050ff28dec9b8f066972ae5e
SHA256

df77f23a93811be258c168169a6245c3a7c8ee7d37801b985c9e745e88f2c5fd
SHA512

65b4a2f0df5f776d9f9e5fb55585395deb20101a370e49e2e16764d6d9ee83756e440b894696fd58daf27119324b9a7c7279e18ca4023373dc41ef6a0eaf0296
SSDEEP

24576:/ReoHLlYd7vb63wWgombBhfJgey3U5DY/ohuQW/t3jt/g3FsK06G:QohY1vqU1bBhfm0O1v/g3Fn/G

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI4	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{11670095-22656874-3E208C5C-826859B9}	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{11670095-22656874-3E208C5C-826859B9}\ = 7fff5dd0cffca2515834f094e479db14b6b4ea1bb9f1a8e04487cac5de68cde280e99e384d6adf80b25b2749f57fd4edc45c5b4ef19cdc8df15cdaa2e56820448a85a6a7a5ba3728559a7bb6a95bdcc9cce001da0b894198f37616dafaced11dcf0f623df06fd5ddcb7046af1b5dc973a42e19428bd6660525db7b0ed1bc77ee55a3477e152d4b5f3ecdd27fb9add43c89107bf0e95c80324a96f874ec58c174b814d638b596a8053ce7908a8c3f7dad90bcc66e05a2e7e1f50c98fec9d3a4beaad21f414dd75ffacdd09c4933dbe90ec4bccaac7f5fedb2e0ee05dd5773b5d994cff4e2255e07cc05c0a7c3f561d4df39cd5700856ca883a0a1e1d0537eb992500744757417d8c54f5b7d71935f8e0d9c433316690a1fe00d05e35b367194d3c876c5a55b47c965e324de344c98e23227de858d88e39846f5b5285bdc49cd6380c988b8612ee3e2c6d805f13b675125b8b76a55b87bd52ec77c5a2ef03cd3ecc1417c1811f4876b1a59f08fdda2f3a896e7853a0bee79dd108cf8a0ab791eebccfeddecf35f6e32e2ee117dcb1006b8b42feb3dbeef6c22004eb2421ea7cce5a108db3c4e6ce282efbf02ad66dcba31572745156bbbd9d68cca617fdf12f2ce21435b1671bae351b64b2559cbcfe6a2f46fa902c4b0541d880f7fdd02cc54b32ec8c2cc480d98262c44f9ed9516dc9b55b5a0620dba7d30426b053798c84d425a6f9eb4509be680452b6e7967004609	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{11670095-22656874-3E208C5C-826859B9}\ = 7fff5dd0cffca2515834f094e479db14b6b4ea1bb9f1a8e04487cac5de68cde280e99e384d6adf80b25b2749f57fd4edc45c5b4ef19cdc8dce9f4332e26820448a85a6a7a5ba3728559a7bb6a95bdcc9cce001da0b894198f37616dafaced11dcf0f623df06fd5ddcb7046af1b5dc973a42e19428bd6660525db7b0ed1bc77ee55a3477e152d4b5f3ecdd27fb9add43c89107bf0e95c80324a96f874ec58c174b814d638b596a8053ce7908a8c3f7dad90bcc66e05a2e7e1f50c98fec9d3a4beaad21f414dd75ffacdd09c4933dbe90ec4bccaac7f5fedb2e0ee05dd5773b5d994cff4e2255e07cc05c0a7c3f561d4df39cd5700856ca883a0a1e1d0537eb992500744757417d8c54f5b7d71935f8e0d9c433316690a1fe00d05e35b367194d3c876c5a55b47c965e324de344c98e23227de858d88e39846f5b5285bdc49cd6380c988b8612ee3e2c6d805f13b675125b8b76a55b87bd52ec77c5a2ef03cd3ecc1417c1811f4876b1a59f08fdda2f3a896e7853a0bee79dd108cf8a0ab791eebccfeddecf35f6e32e2ee117dcb1006b8b42feb3dbeef6c22004eb2421ea7cce5a108db3c4e6ce282efbf02ad66dcba31572745156bbbd9d68cca617fdf12f2ce21435b1671bae351b64b2559cbcfe6a2f46fa902c4b0541d880f7fdd02cc54b32ec8c2cc480d98262c44f9ed9516dc9b55b5a0620dba7d30426b053798c84d425a6f9eb4509be680452b6e794feaebcf	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}\ = "2420490390"	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{11670095-22656874-3E208C5C-826859B9}\ = 7fff5dd0cffca2515834f094e479db14b6b4ea1bb9f1a8e04487cac5de68cde280e99e384d6adf80b25b2749f57fd4edc45c5b4ef19cdc8dce9f4332e26820441c45e337a5ba3728559a7bb6a95bdcc9cce001da0b894198f37616dafaced11dcf0f623df06fd5ddcb7046af1b5dc973a42e19428bd6660525db7b0ed1bc77ee55a3477e152d4b5f3ecdd27fb9add43c89107bf0e95c80324a96f874ec58c174b814d638b596a8053ce7908a8c3f7dad90bcc66e05a2e7e1f50c98fec9d3a4beaad21f414dd75ffacdd09c4933dbe90ec4bccaac7f5fedb2e0ee05dd5773b5d994cff4e2255e07cc05c0a7c3f561d4df39cd5700856ca883a0a1e1d0537eb992500744757417d8c54f5b7d71935f8e0d9c433316690a1fe00d05e35b367194d3c876c5a55b47c965e324de344c98e23227de858d88e39846f5b5285bdc49cd6380c988b8612ee3e2c6d805f13b675125b8b76a55b87bd52ec77c5a2ef03cd3ecc1417c1811f4876b1a59f08fdda2f3a896e7853a0bee79dd108cf8a0ab791eebccfeddecf35f6e32e2ee117dcb1006b8b42feb3dbeef6c22004eb2421ea7cce5a108db3c4e6ce282efbf02ad66dcba31572745156bbbd9d68cca617fdf12f2ce21435b1671bae351b64b2559cbcfe6a2f46fa902c4b0541d880f7fdd02cc54b32ec8c2cc480d98262c44f9ed9516dc9b55b5a0620dba7d30426b053798c84d425a6f9eb4509be680452b6e79c871ee52	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2408	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2408	1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI4

Filesize
528B

MD5
2fdc7ebb58ef8895b7ed3891a880a9aa

SHA1
27afc960e494eba45ec2508eef1e8ba93ffdce3f

SHA256
020c09e189530ecb5e3ef2a9deb8e576ac11c43c5ecfc9c3fac0da5b11ced3c1

SHA512
620eded33334301392876968693c8ad40db9f745d8ce02d9a891e21239c2252121d71ad3baa656a14cf9238fc53c2bceee0f0cb514e35111c6add86d73dae62b

Download Submit
memory/2408-9-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/2408-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2408-14-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/2408-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2408-11-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads