Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 07:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe
-
Size
248KB
-
MD5
195a7897bd3d5d1a1aa7683a10921909
-
SHA1
e3adf808d5774a79f5857622951aa96f430ed2a5
-
SHA256
4c75cc11f7d6c7755219d05c568e7a069612e770c6f8a26aa05fe240fffd1bc9
-
SHA512
40c0e53dea4a4d41be3952708fe36aa0af60c4c15fe3e88b1ac616b7505fe1acd4322eeb16f13372b60645b0dc089f4d902b429772e0b930498ee4a0406df0c2
-
SSDEEP
6144:kD07J6Y0d/RCH3erL/sLAsLPfc/UDgKJ1s4EWqZA7Q/DxoI3sDP4QtNINHKbhFJc:D7Jh0d/RCHOrL/sLAsLP9+AKtF3sDwnG
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" siwiy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1900 siwiy.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /e" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /S" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /q" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /f" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /C" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /Q" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /y" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /I" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /U" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /m" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /d" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /j" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /A" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /T" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /b" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /B" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /D" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /p" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /H" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /a" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /s" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /x" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /c" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /l" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /F" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /G" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /n" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /X" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /w" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /v" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /k" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /N" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /g" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /R" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /W" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /Y" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /O" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /u" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /Z" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /h" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /L" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /V" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /M" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /t" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /K" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /o" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /J" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /r" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /z" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /P" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /i" siwiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwiy = "C:\\Users\\Admin\\siwiy.exe /E" siwiy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe 1900 siwiy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 828 195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe 1900 siwiy.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 828 wrote to memory of 1900 828 195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe 85 PID 828 wrote to memory of 1900 828 195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe 85 PID 828 wrote to memory of 1900 828 195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\195a7897bd3d5d1a1aa7683a10921909_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\siwiy.exe"C:\Users\Admin\siwiy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD59fbf371217d592cb119e68b2aac0cdda
SHA1db29924086e6487cf3554a0efb09325d44c325ca
SHA2569d04c9d31d686d4a26727e4521417b8ef1130e4360a190c546185f4243a83056
SHA51299ea243aa62ddc060eda9f4e2c16816c44077daeadd6f303e3c48578aa131f4da0571afe75164190952ad23f445a574b4f4b6753515403bb337f48b660a38be8