Analysis
-
max time kernel
149s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 23:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe
-
Size
152KB
-
MD5
17f1e443761a951d39ee00d9fb9ee94d
-
SHA1
3977df63ec554d145f56212467dd1361a7b7ca0a
-
SHA256
607f14870fda6bc4f03dfd25231ebd918355842be2d55580fb1e69cc60b27c09
-
SHA512
f29f8b2bd637625dc9f56dbd80431c006c10c711940baca2a169d6729215f1e74a00f499fad1627835b24ce53f5986df5cb9e6734392eed33e1ca975b6edaca5
-
SSDEEP
3072:T3jIpK9xKA9w2p4QZisLaazNiIIkyyqN4oQZiE9vOGy:T3cpKxY+1isuazgfklcWvm
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zaigai.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1736 zaigai.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /n" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /Z" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /E" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /F" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /v" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /S" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /f" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /U" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /t" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /j" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /D" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /T" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /k" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /y" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /r" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /O" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /A" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /s" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /K" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /q" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /L" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /J" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /u" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /o" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /Y" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /i" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /X" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /b" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /l" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /G" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /x" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /B" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /W" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /d" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /z" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /V" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /c" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /g" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /R" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /N" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /a" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /w" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /Q" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /d" 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /H" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /e" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /P" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /m" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /p" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /M" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /C" zaigai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaigai = "C:\\Users\\Admin\\zaigai.exe /I" zaigai.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4416 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe 4416 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe 1736 zaigai.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4416 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe 1736 zaigai.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4416 wrote to memory of 1736 4416 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe 85 PID 4416 wrote to memory of 1736 4416 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe 85 PID 4416 wrote to memory of 1736 4416 17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17f1e443761a951d39ee00d9fb9ee94d_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\zaigai.exe"C:\Users\Admin\zaigai.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD57d9b3f0f8ce463f2921b0d9bcc4e383b
SHA1a6988b144f0a40cc35708b479073c496586305c2
SHA25663bf2b36a473e38b1fd3add2db1ac36a7564b4c735d473c00663ac1d673a3f2a
SHA51220415430c7d1c1b0086c231fae15bd6ec0ccf896006df582e3d221bf21ab1bd11cfa004139b8b4a9c4fccfce87f50814f4fac0193c0d94df6b6062cc3fd062b5