edffa3d797694733475538588c4a17b5860856cf4b65b702bf6b918a4bd5f5ef

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
Size

171KB
MD5

05ea1ab26db458ec07e37e2d8d19c2e2
SHA1

ac56a2e1372c23a5f8a09a7f9f6ef15706256277
SHA256

edffa3d797694733475538588c4a17b5860856cf4b65b702bf6b918a4bd5f5ef
SHA512

a3757ddf6ae5181b6a71e5cd2603fbed1546e7f1e15b28172d48c71bb7813a76f92cfdbf64f4090457895d7f648d95f81eaa746db730b47bb92688e5f7f50fdd
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DERAFtF:gDCwfG1bnxLERWtF

Score

10^/10

defense_evasion evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GSAGMHCQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GSAGMHCQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GSAGMHCQ = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
3224	avscan.exe
1556	avscan.exe
1572	hosts.exe
1864	hosts.exe
2572	avscan.exe
4584	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
File created	\??\c:\windows\W_X_C.bat	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
File opened for modification	C:\Windows\hosts.exe	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2244	REG.exe
1776	REG.exe
2516	REG.exe
3540	REG.exe
3732	REG.exe
2968	REG.exe
1400	REG.exe
4004	REG.exe
2492	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3224	avscan.exe
1572	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
3224	avscan.exe
1556	avscan.exe
1572	hosts.exe
1864	hosts.exe
2572	avscan.exe
4584	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2492	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	83
PID 1376 wrote to memory of 2492	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	83
PID 1376 wrote to memory of 2492	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	83
PID 1376 wrote to memory of 3224	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	85
PID 1376 wrote to memory of 3224	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	85
PID 1376 wrote to memory of 3224	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	85
PID 3224 wrote to memory of 1556	3224	avscan.exe	86
PID 3224 wrote to memory of 1556	3224	avscan.exe	86
PID 3224 wrote to memory of 1556	3224	avscan.exe	86
PID 3224 wrote to memory of 2412	3224	avscan.exe	87
PID 3224 wrote to memory of 2412	3224	avscan.exe	87
PID 3224 wrote to memory of 2412	3224	avscan.exe	87
PID 1376 wrote to memory of 5048	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	88
PID 1376 wrote to memory of 5048	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	88
PID 1376 wrote to memory of 5048	1376	05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe	88
PID 5048 wrote to memory of 1572	5048	cmd.exe	91
PID 5048 wrote to memory of 1572	5048	cmd.exe	91
PID 5048 wrote to memory of 1572	5048	cmd.exe	91
PID 2412 wrote to memory of 1864	2412	cmd.exe	92
PID 2412 wrote to memory of 1864	2412	cmd.exe	92
PID 2412 wrote to memory of 1864	2412	cmd.exe	92
PID 1572 wrote to memory of 2572	1572	hosts.exe	93
PID 1572 wrote to memory of 2572	1572	hosts.exe	93
PID 1572 wrote to memory of 2572	1572	hosts.exe	93
PID 5048 wrote to memory of 1472	5048	cmd.exe	94
PID 5048 wrote to memory of 1472	5048	cmd.exe	94
PID 5048 wrote to memory of 1472	5048	cmd.exe	94
PID 1572 wrote to memory of 3492	1572	hosts.exe	95
PID 1572 wrote to memory of 3492	1572	hosts.exe	95
PID 1572 wrote to memory of 3492	1572	hosts.exe	95
PID 2412 wrote to memory of 3264	2412	cmd.exe	97
PID 2412 wrote to memory of 3264	2412	cmd.exe	97
PID 2412 wrote to memory of 3264	2412	cmd.exe	97
PID 3492 wrote to memory of 4584	3492	cmd.exe	99
PID 3492 wrote to memory of 4584	3492	cmd.exe	99
PID 3492 wrote to memory of 4584	3492	cmd.exe	99
PID 3492 wrote to memory of 1484	3492	cmd.exe	100
PID 3492 wrote to memory of 1484	3492	cmd.exe	100
PID 3492 wrote to memory of 1484	3492	cmd.exe	100
PID 3224 wrote to memory of 2516	3224	avscan.exe	103
PID 3224 wrote to memory of 2516	3224	avscan.exe	103
PID 3224 wrote to memory of 2516	3224	avscan.exe	103
PID 1572 wrote to memory of 3540	1572	hosts.exe	105
PID 1572 wrote to memory of 3540	1572	hosts.exe	105
PID 1572 wrote to memory of 3540	1572	hosts.exe	105
PID 3224 wrote to memory of 3732	3224	avscan.exe	112
PID 3224 wrote to memory of 3732	3224	avscan.exe	112
PID 3224 wrote to memory of 3732	3224	avscan.exe	112
PID 1572 wrote to memory of 2244	1572	hosts.exe	114
PID 1572 wrote to memory of 2244	1572	hosts.exe	114
PID 1572 wrote to memory of 2244	1572	hosts.exe	114
PID 3224 wrote to memory of 2968	3224	avscan.exe	116
PID 3224 wrote to memory of 2968	3224	avscan.exe	116
PID 3224 wrote to memory of 2968	3224	avscan.exe	116
PID 1572 wrote to memory of 1400	1572	hosts.exe	118
PID 1572 wrote to memory of 1400	1572	hosts.exe	118
PID 1572 wrote to memory of 1400	1572	hosts.exe	118
PID 3224 wrote to memory of 1776	3224	avscan.exe	120
PID 3224 wrote to memory of 1776	3224	avscan.exe	120
PID 3224 wrote to memory of 1776	3224	avscan.exe	120
PID 1572 wrote to memory of 4004	1572	hosts.exe	122
PID 1572 wrote to memory of 4004	1572	hosts.exe	122
PID 1572 wrote to memory of 4004	1572	hosts.exe	122

C:\Users\Admin\AppData\Local\Temp\05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05ea1ab26db458ec07e37e2d8d19c2e2_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Modifies registry key
  PID:2492
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:3264
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2516
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3732
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2968
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4584
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:1484
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3540
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:2244
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1400
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4004
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
171KB

MD5
70f820b3e02c916e7b941c6c3989afcc

SHA1
170fd2e0ba76ebdb91513974589f20db50e41259

SHA256
cde7080667feb2ab8439f765ffb239d027f4ce2b83c3f6c7b83703bd952f18dc

SHA512
fcead2800b7d3388e8f5f8e873dde77f34e138c11ecf15eb4df28b42ee5fa9b8128f3d9af66c8615891510a02f3ca4fbb09f070c82ac7556a25cd85a38d9cc5f

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
52bacc7bb948324274f50a15cc06257e

SHA1
735ee78395c7e4d0c2fe265c2f018d120aa747b2

SHA256
5248f9121ef1e7529aa4a2ca8556fdcdb78cdb33bd9908e8d8e15d6b625c4740

SHA512
ce7f90a86fbdab8f320705f3ee185d8aa70b65433cb52d0087b76ea0810ad4298bc19258bd7f93ef36bc018b8c7557a5aa14156f070c6f14cba25a0c5f23437c

Download Submit
C:\Windows\hosts.exe

Filesize
171KB

MD5
548f2e0114684d387ebed33494919da7

SHA1
ceb4f07eddb27771377620fbb5bca48a8c64b20a

SHA256
90ba98d793b16ba96c74faf2ecd227df3add4fd9285a0f83b636af81f003c3bf

SHA512
c469842a53aada12886a3833ca73f8111a62ebdae81cc49809749dcf94482d6334e7510329d8b8e06a8b5f19ae77d85f0b387caec617f2c31e1aac9947d82a94

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads