d85bd4d06c7b84f22980e36da1b11a18f66b1bf63579ac0dc6769ea422293d8b

Analysis

max time kernel
13s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe
Size

76KB
MD5

0319f4a199d00562e1e2458c01deef1a
SHA1

07be3534eb0d269d1d0ee2addd711e03d5f8bb39
SHA256

d85bd4d06c7b84f22980e36da1b11a18f66b1bf63579ac0dc6769ea422293d8b
SHA512

9b65ed8be9481359dd41a15fa32870b88b7a1131b2aaf9919d5e3e634cc0c7177907cde624c9a28d49404f43d435ea742cfbda1804f55768680ca69086f97d52
SSDEEP

768:1FGPbKIflMdYYLqsouZFRELqFlhFM/aCKdN27fx0Xn6YOD5ryTUu:1QPb3aL2uZFxlD8K727fxi6Ycu

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jeougif.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
228	jeougif.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeougif = "C:\\Users\\Admin\\jeougif.exe"	jeougif.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
228	jeougif.exe
228	jeougif.exe
228	jeougif.exe
228	jeougif.exe
228	jeougif.exe
228	jeougif.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4548	0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe
228	jeougif.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 228	4548	0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe	94
PID 4548 wrote to memory of 228	4548	0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe	94
PID 4548 wrote to memory of 228	4548	0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe	94
PID 228 wrote to memory of 4548	228	jeougif.exe	85
PID 228 wrote to memory of 4548	228	jeougif.exe	85
PID 228 wrote to memory of 4548	228	jeougif.exe	85
PID 228 wrote to memory of 4548	228	jeougif.exe	85

C:\Users\Admin\AppData\Local\Temp\0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0319f4a199d00562e1e2458c01deef1a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\jeougif.exe
  "C:\Users\Admin\jeougif.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\jeougif.exe

Filesize
76KB

MD5
0f4c6a7f6cb440633061c32bac89c585

SHA1
614ae20acfab1cceef6ab5ceef71af76f580deb2

SHA256
69824e03a5200545c204273d204621b547ff76b79ffc1c35c961bbed72b88922

SHA512
4237b5f898caf69ebdc8d08fe6be6e5e991adfc89625d1824ae6f71f3aee5230f7a1cf480b92782414b5dc99cbd1fde190c5493f196cbcaf9c3449594847f7d2

Download Submit