e58cf6ad9cec6fff03e64f82e18364fa5e5dc5de8972c35fb6761eab4eca1e2e

General

Target

d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Size

951KB
MD5

d7a3e49a7c35c45184756780b5afc463
SHA1

3dfaad93979bb47fb78c12cda73575510e6f62b3
SHA256

e58cf6ad9cec6fff03e64f82e18364fa5e5dc5de8972c35fb6761eab4eca1e2e
SHA512

61d875d498c39b572626a5253cf39aeebc4c3268c6ea9cf3e69fad47dce718833d2cd943885690e50f78897bc5acd1f5329c2a473f4364c2c6d0673da445d2e0
SSDEEP

12288:RG5W3NwL57YMY//MNGxk4y0XOy2dKPJniUUYI9RFa3cMGVhVN9OfXQ2Yvg4NlDVP:RG5VLFySGG47+e49qzswgx28lhPrgE

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI4	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{353FEE06-01523B37-6496DB4E-CE251FD8}	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{353FEE06-01523B37-6496DB4E-CE251FD8}\ = def28ee671c692c9bca961b102da8b84b3991b81bbf5649ae7c41849850a45b4b62958d2b94c1953c684669429b7d627463846d9d7018715adf3983e52c13966e23904ded50089304ed5d1f98d22ae0bb02cda90fdfb9d5bc2fb745cd5ff799f2680c7cab8151c4a7d0bde8c7e0eded1bfb99fa1bf22e04ba0d3977cb7e3979b077c68ddf10251c3f6db16bcf7dea74187c2e88c9493f9fb99e3ba6ca22da2eef36e234fabb0acdcaebdb021e562c5d3594b3acce30f04f02593cabb8de30dfc315ca27fcaa08be2ebf26b55d40a788cddcd7d711eed01926a8455a6ba89e535192642387565265a27fc5821431a0cbc6fa1b061e165d15609096a56abf9cc6532d563466c89ce29ef362fe90f0ef011d6ca37cb58eb78ebe394a3ca134a74f5a555f636d8e74687b75857c3b8fb1e64805725f8c6de688113390c25129a0b028cc5f2765b99fc7a5e23811371446d1712484b13340c25534684570a8833151b8a3c749dd7bdc75e8781e8ad8c72d35dbbbedcde40bfc0df937f73e0ec1832b8e559e5fae9e2ae43ee545039bda2a1dc157e3aa1e585d946be49de16bf77dfe8407625d7b9471ec8ff4e5f2f00d0ebbf941f4840cbff2b5f9380844aba2ddaf2fd5a9d3dc2de0abf921f8d3f6da092d244446ab933a1ac2d920e0b11ec2d3987ae5fcb37bc5a02599e89bdff9402e3417659178ef4c505a3e30cbe12cafd6b58d3ac31633dffeb197202d0fd92421db0	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{353FEE06-01523B37-6496DB4E-CE251FD8}\ = def28ee671c692c9bca961b102da8b84b3991b81bbf5649ae7c41849850a45b4b62958d2b94c1953c684669429b7d627463846d9d7018715783aa19d55c13966e23904ded50089304ed5d1f98d22ae0bb02cda90fdfb9d5bc2fb745cd5ff799f2680c7cab8151c4a7d0bde8c7e0eded1bfb99fa1bf22e04ba0d3977cb7e3979b077c68ddf10251c3f6db16bcf7dea74187c2e88c9493f9fb99e3ba6ca22da2eef36e234fabb0acdcaebdb021e562c5d3594b3acce30f04f02593cabb8de30dfc315ca27fcaa08be2ebf26b55d40a788cddcd7d711eed01926a8455a6ba89e535192642387565265a27fc5821431a0cbc6fa1b061e165d15609096a56abf9cc6532d563466c89ce29ef362fe90f0ef011d6ca37cb58eb78ebe394a3ca134a74f5a555f636d8e74687b75857c3b8fb1e64805725f8c6de688113390c25129a0b028cc5f2765b99fc7a5e23811371446d1712484b13340c25534684570a8833151b8a3c749dd7bdc75e8781e8ad8c72d35dbbbedcde40bfc0df937f73e0ec1832b8e559e5fae9e2ae43ee545039bda2a1dc157e3aa1e585d946be49de16bf77dfe8407625d7b9471ec8ff4e5f2f00d0ebbf941f4840cbff2b5f9380844aba2ddaf2fd5a9d3dc2de0abf921f8d3f6da092d244446ab933a1ac2d920e0b11fcf43987ae5fcb37bc5a02599e89bdff9402e3417659178ef4c505a3e30cbe12cafd6b58d3ac31633dffeb197202d0fd6b7d365b	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\{D50DBC70-EDF2330C-38FF8F7C}\ = "4008726737"	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{353FEE06-01523B37-6496DB4E-CE251FD8}\ = def28ee671c692c9bca961b102da8b84b3991b81bbf5649ae7c41849850a45b4b62958d2b94c1953c684669429b7d627463846d9d7018715783aa19d55c139663369f430d50089304ed5d1f98d22ae0bb02cda90fdfb9d5bc2fb745cd5ff799f2680c7cab8151c4a7d0bde8c7e0eded1bfb99fa1bf22e04ba0d3977cb7e3979b077c68ddf10251c3f6db16bcf7dea74187c2e88c9493f9fb99e3ba6ca22da2eef36e234fabb0acdcaebdb021e562c5d3594b3acce30f04f02593cabb8de30dfc315ca27fcaa08be2ebf26b55d40a788cddcd7d711eed01926a8455a6ba89e535192642387565265a27fc5821431a0cbc6fa1b061e165d15609096a56abf9cc6532d563466c89ce29ef362fe90f0ef011d6ca37cb58eb78ebe394a3ca134a74f5a555f636d8e74687b75857c3b8fb1e64805725f8c6de688113390c25129a0b028cc5f2765b99fc7a5e23811371446d1712484b13340c25534684570a8833151b8a3c749dd7bdc75e8781e8ad8c72d35dbbbedcde40bfc0df937f73e0ec1832b8e559e5fae9e2ae43ee545039bda2a1dc157e3aa1e585d946be49de16bf77dfe8407625d7b9471ec8ff4e5f2f00d0ebbf941f4840cbff2b5f9380844aba2ddaf2fd5a9d3dc2de0abf921f8d3f6da092d244446ab933a1ac2d920e0b11ccdf3987ae5fcb37bc5a02599e89bdff9402e3417659178ef4c505a3e30cbe12cafd6b58d3ac31633dffeb197202d0fd9d8041e0	d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d7a3e49a7c35c45184756780b5afc463_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI4

Filesize
528B

MD5
875880f3a080f21669ec72446c619e56

SHA1
69c04dc26e8687c15f6af7f14054b4b9a8bb3a58

SHA256
c266932fdc0e19506d7072813a381c007cf4adbe7d51e98a385f62baee1f93b0

SHA512
348fad355fd8f477bdd5ef21afdb24124838222e673b3b781c43381c8d17c43d7b8339144b4abd3988fbed71d1d4a7af86dc89ad1684572fa6924d43e44ed10e

Download Submit
memory/3016-9-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/3016-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3016-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3016-11-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads