Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 08:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0783b337146ac5047652304f76320c83_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0783b337146ac5047652304f76320c83_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0783b337146ac5047652304f76320c83_JaffaCakes118.exe
-
Size
136KB
-
MD5
0783b337146ac5047652304f76320c83
-
SHA1
40050ae9bd4ff9f0f128751ab2399e0852c40251
-
SHA256
3516387457324ae99923365d936641e512c8eec577c07cec1b1bc4be60fdb09a
-
SHA512
404fd5cfd35a019f4c9f0debc99c77d0c9e5e9b2fb4212ba57594fc9467cb0eb37f5d37b08944a2402d7efb70bcb79cf43ce57dcb2b89724fd31c19ad7da133b
-
SSDEEP
1536:YkskoBVL5nPn5QaTNUbaxaZ65gX4Pv9u2y0aZAbs/nLziow28fz+DliO3MxsawEN:/uVIkUbaxHg+g/nvif7hsAMW+8
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0783b337146ac5047652304f76320c83_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zuogiey.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 0783b337146ac5047652304f76320c83_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1284 zuogiey.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /j" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /D" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /x" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /L" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /J" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /p" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /i" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /m" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /I" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /S" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /l" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /t" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /f" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /g" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /u" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /E" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /a" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /w" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /G" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /h" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /P" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /W" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /F" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /n" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /Y" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /V" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /r" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /q" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /K" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /d" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /T" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /R" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /o" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /Q" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /e" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /N" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /C" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /k" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /O" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /B" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /Z" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /b" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /H" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /M" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /v" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /W" 0783b337146ac5047652304f76320c83_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /c" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /A" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /s" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /y" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /z" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /X" zuogiey.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuogiey = "C:\\Users\\Admin\\zuogiey.exe /U" zuogiey.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3292 0783b337146ac5047652304f76320c83_JaffaCakes118.exe 3292 0783b337146ac5047652304f76320c83_JaffaCakes118.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe 1284 zuogiey.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3292 0783b337146ac5047652304f76320c83_JaffaCakes118.exe 1284 zuogiey.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3292 wrote to memory of 1284 3292 0783b337146ac5047652304f76320c83_JaffaCakes118.exe 83 PID 3292 wrote to memory of 1284 3292 0783b337146ac5047652304f76320c83_JaffaCakes118.exe 83 PID 3292 wrote to memory of 1284 3292 0783b337146ac5047652304f76320c83_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\0783b337146ac5047652304f76320c83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0783b337146ac5047652304f76320c83_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\zuogiey.exe"C:\Users\Admin\zuogiey.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD54e3a1cb30e7889124aa4309c678d2c65
SHA19dff194a23dfbcad30f9745cbc0a291b40a58f95
SHA2565951b0fd6029b1a41fb49f10476939d7eae30e01102e9a6bb432bd9d525fde73
SHA51280d2db7b9d3f8499e1b37b1e49ada4c8d0e76124eecac166ff7ba741477cce2eecfc4ccdb2abfcf78a1588eb5a256e7730451d98b28b96f324917bdd502ccc36