cb0ea9ee103ce800a35f42d65832781a41c15c5ff93b98d5b01be7e9bd6b4599

Analysis

max time kernel
150s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe
Size

88KB
MD5

0a5f71b360f68f03d5643f94e3fa5907
SHA1

069cb6071376adc86092f054f4b26e50ae161fb6
SHA256

cb0ea9ee103ce800a35f42d65832781a41c15c5ff93b98d5b01be7e9bd6b4599
SHA512

f13c2e7e30c3071d935c6ce1cfbec4bb2fa0388943ac1e10e74e43b79d122b6555fdb3929ad116f2adabeb23d136604c0947f9b34e30dc7232d5e39bdb27c5b9
SSDEEP

1536:P2KeSpy8tXG06YpqdXTsYJ/F+FBFIFGFYF7DUZxTZJ3a:4Ss0G0mZ0K

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	xaaago.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4972	xaaago.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /G"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /v"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /Q"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /j"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /N"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /q"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /m"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /F"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /L"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /C"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /t"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /H"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /h"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /K"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /o"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /p"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /z"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /x"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /S"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /W"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /R"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /u"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /i"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /I"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /s"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /Y"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /V"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /w"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /T"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /Z"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /b"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /r"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /X"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /l"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /g"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /O"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /B"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /c"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /A"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /D"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /P"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /M"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /y"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /U"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /f"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /a"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /J"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /k"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /e"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /n"	xaaago.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaago = "C:\\Users\\Admin\\xaaago.exe /E"	xaaago.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe
4972	xaaago.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1060	0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe
4972	xaaago.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4972	1060	0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe	81
PID 1060 wrote to memory of 4972	1060	0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe	81
PID 1060 wrote to memory of 4972	1060	0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a5f71b360f68f03d5643f94e3fa5907_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\xaaago.exe
  "C:\Users\Admin\xaaago.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\xaaago.exe

Filesize
88KB

MD5
f75afe3e44e406fa658790c21f93fb6c

SHA1
55e6cf7355b291954a719e6f8f0a60eba8e380ce

SHA256
ec4cb1edbb3eca356f721ceb12b52c5b956c3f278a28ae2716267c8a307c1f85

SHA512
9f96788bf5a56f674516febe4690b7d777bc3103ba349ba30c0971579d8fa4e4273da7646a3ee6516bcb7cadce3cb4cf6517dbf1cc8f7b193d96bf2917d2e0c1

Download Submit