8551076256854d724484fad6fa2156f3529ba5bd6074ede64a8f77c4843643fc

Analysis

max time kernel
122s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
Size

217KB
MD5

23fbdff109d7dc6d51b7747f94ab3373
SHA1

830401e58c42a95c7b823c3bf60760c88fbab5dd
SHA256

8551076256854d724484fad6fa2156f3529ba5bd6074ede64a8f77c4843643fc
SHA512

4c6fa36dc60b496fbd7d2e4e2ebc293311e99e6cc35a79cdfb7bbc1437e5fc365346b6a9ecc0ed5e852c72ee55ce0c635f10f92cd632d8a42549f733dd66ea8b
SSDEEP

3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQB17lgVUInUpmsPssU9I:gDCwfG1bnxLERRMlmjUosPsdI

Score

10^/10

defense_evasion evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OBJIYUIE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OBJIYUIE = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\OBJIYUIE = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
876	avscan.exe
3124	avscan.exe
2824	hosts.exe
2592	hosts.exe
4800	avscan.exe
464	hosts.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	REG.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	REG.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
File created	\??\c:\windows\W_X_C.bat	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
File opened for modification	C:\Windows\hosts.exe	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3572	REG.exe
3908	REG.exe
4148	REG.exe
1792	REG.exe
4592	REG.exe
4776	REG.exe
3216	REG.exe
844	REG.exe
4148	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
876	avscan.exe
2824	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
876	avscan.exe
3124	avscan.exe
2592	hosts.exe
2824	hosts.exe
4800	avscan.exe
464	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4148	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	81
PID 2944 wrote to memory of 4148	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	81
PID 2944 wrote to memory of 4148	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	81
PID 2944 wrote to memory of 876	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	83
PID 2944 wrote to memory of 876	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	83
PID 2944 wrote to memory of 876	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	83
PID 876 wrote to memory of 3124	876	avscan.exe	84
PID 876 wrote to memory of 3124	876	avscan.exe	84
PID 876 wrote to memory of 3124	876	avscan.exe	84
PID 876 wrote to memory of 1424	876	avscan.exe	85
PID 876 wrote to memory of 1424	876	avscan.exe	85
PID 876 wrote to memory of 1424	876	avscan.exe	85
PID 2944 wrote to memory of 1760	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	86
PID 2944 wrote to memory of 1760	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	86
PID 2944 wrote to memory of 1760	2944	23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe	86
PID 1424 wrote to memory of 2824	1424	cmd.exe	89
PID 1424 wrote to memory of 2824	1424	cmd.exe	89
PID 1424 wrote to memory of 2824	1424	cmd.exe	89
PID 1760 wrote to memory of 2592	1760	cmd.exe	90
PID 1760 wrote to memory of 2592	1760	cmd.exe	90
PID 1760 wrote to memory of 2592	1760	cmd.exe	90
PID 2824 wrote to memory of 4800	2824	hosts.exe	91
PID 2824 wrote to memory of 4800	2824	hosts.exe	91
PID 2824 wrote to memory of 4800	2824	hosts.exe	91
PID 1760 wrote to memory of 1404	1760	cmd.exe	92
PID 1760 wrote to memory of 1404	1760	cmd.exe	92
PID 1760 wrote to memory of 1404	1760	cmd.exe	92
PID 1424 wrote to memory of 4628	1424	cmd.exe	93
PID 1424 wrote to memory of 4628	1424	cmd.exe	93
PID 1424 wrote to memory of 4628	1424	cmd.exe	93
PID 2824 wrote to memory of 2120	2824	hosts.exe	94
PID 2824 wrote to memory of 2120	2824	hosts.exe	94
PID 2824 wrote to memory of 2120	2824	hosts.exe	94
PID 2120 wrote to memory of 464	2120	cmd.exe	97
PID 2120 wrote to memory of 464	2120	cmd.exe	97
PID 2120 wrote to memory of 464	2120	cmd.exe	97
PID 2120 wrote to memory of 2952	2120	cmd.exe	98
PID 2120 wrote to memory of 2952	2120	cmd.exe	98
PID 2120 wrote to memory of 2952	2120	cmd.exe	98
PID 876 wrote to memory of 4776	876	avscan.exe	107
PID 876 wrote to memory of 4776	876	avscan.exe	107
PID 876 wrote to memory of 4776	876	avscan.exe	107
PID 2824 wrote to memory of 3572	2824	hosts.exe	109
PID 2824 wrote to memory of 3572	2824	hosts.exe	109
PID 2824 wrote to memory of 3572	2824	hosts.exe	109
PID 876 wrote to memory of 3216	876	avscan.exe	112
PID 876 wrote to memory of 3216	876	avscan.exe	112
PID 876 wrote to memory of 3216	876	avscan.exe	112
PID 2824 wrote to memory of 3908	2824	hosts.exe	114
PID 2824 wrote to memory of 3908	2824	hosts.exe	114
PID 2824 wrote to memory of 3908	2824	hosts.exe	114
PID 876 wrote to memory of 4148	876	avscan.exe	116
PID 876 wrote to memory of 4148	876	avscan.exe	116
PID 876 wrote to memory of 4148	876	avscan.exe	116
PID 2824 wrote to memory of 1792	2824	hosts.exe	118
PID 2824 wrote to memory of 1792	2824	hosts.exe	118
PID 2824 wrote to memory of 1792	2824	hosts.exe	118
PID 876 wrote to memory of 844	876	avscan.exe	120
PID 876 wrote to memory of 844	876	avscan.exe	120
PID 876 wrote to memory of 844	876	avscan.exe	120
PID 2824 wrote to memory of 4592	2824	hosts.exe	122
PID 2824 wrote to memory of 4592	2824	hosts.exe	122
PID 2824 wrote to memory of 4592	2824	hosts.exe	122

C:\Users\Admin\AppData\Local\Temp\23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23fbdff109d7dc6d51b7747f94ab3373_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Modifies registry key
  PID:4148
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
        
        C:\Users\Admin\AppData\Local\Temp\avscan.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2120
      - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        6⤵
        Adds policy Run key to start application
        
        PID:2952
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3572
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:3908
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:1792
    - - C:\Windows\SysWOW64\REG.exe
        
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        5⤵
        Modifies registry key
        
        PID:4592
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4628
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4776
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3216
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4148
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2592
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:1404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
217KB

MD5
ea2d6e29361aa528b348e348f79bf652

SHA1
a64c93756269cb2e5870228a16c6f22bc3c4721a

SHA256
aa8e3e1acb9f71468cfb87bfeefb3c494018ee2dbbdc110b1196560cd3ab7cbb

SHA512
465cc2633da8ab4f6bb60942245221b3e2f32e0f5f05a255613496c9e78d8896bb6d309969ef30c5d464aff09bdc79810db77d5f5936003fd089242e24b015ad

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
1b97fc0bf80f44c04514817b1c7449e7

SHA1
1b32070bd87946ce42e7c3e49a47e282b2622852

SHA256
e756c1e489a198dd4dd1536efb045f4a14054e7902931f6af0cf13343f60cb4c

SHA512
be89f25cf5ba8635dda55c20c249233c68a488d9a76f73f4a259dc994c26938b58a57b67f16d6ce477213b27f19bdc3ca6e43443925fa218f58418e128eb7fc2

Download Submit
C:\Windows\hosts.exe

Filesize
217KB

MD5
6f40b6ea6e4ee067e2ae7fe9bd205819

SHA1
da90b5d30545e78bf54cab745908922c53a4f170

SHA256
3a0a772ac6cb41142e62d02adb4d8852da48cf7fc31575f2e860fef4a3170664

SHA512
6e05f56f0c9efa2312c20c5e5a6c27a3daa7dd19086811dc963324242b6191ff19333bab44e7f896a0a55620df190d20500c58f034c1ef9c086d838157df27f0

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads