Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe
-
Size
240KB
-
MD5
0a6abd938fab388897426ab21e136edc
-
SHA1
29e3d5fc988ceee84b73ea73f4a4c0901f48ada1
-
SHA256
448677c2289844c630a71fc8bbd2eb786d266b1f061d5f0a9773723c0613f5bd
-
SHA512
c3a12ffec2f1f864d8510ae2061e1161c2bb3b22f2847d74f394bc26a1d97b80baef0864ee073224af6b9a0dfcb4857f186f7da3601308d7cb353bcc93505fca
-
SSDEEP
6144:vU3L3dwqsNwemAB0EqxF6snji81RUinKchhypSQ:SdQQJsw
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toenau.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4312 toenau.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /w" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /b" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /r" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /a" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /v" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /c" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /n" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /x" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /m" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /y" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /u" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /d" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /b" 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /z" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /l" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /t" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /o" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /p" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /s" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /q" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /g" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /h" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /j" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /k" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /e" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /f" toenau.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toenau = "C:\\Users\\Admin\\toenau.exe /i" toenau.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2464 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe 2464 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe 4312 toenau.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2464 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe 4312 toenau.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2464 wrote to memory of 4312 2464 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe 92 PID 2464 wrote to memory of 4312 2464 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe 92 PID 2464 wrote to memory of 4312 2464 0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a6abd938fab388897426ab21e136edc_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\toenau.exe"C:\Users\Admin\toenau.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1324 /prefetch:81⤵PID:1740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5f4dc14b2b878176f5d549bdf170d9efd
SHA1cec67899d66abb08e99b6281ffa2a7b03ada6091
SHA2567ae5463736833958e9fe8efbd10b97d80688916ac44312bf3428f2763fa92f1e
SHA512faf2f5df1abbf14e63679510420db9f59e346bc63f915771d0649d7d89d7be3e2b7a87c7258754713c80b48048ba0eaa2e834a1be58836a63ec721ad47ebcf58