Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 09:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe
-
Size
228KB
-
MD5
256a89afbbe4699c228343485e1bbefc
-
SHA1
ac0cacf19fffb10dc6ef32da74933985907f5825
-
SHA256
98c8da8c096a581bffdfcfcd3fa26063fb780a0242c6d431b58636ff9d445c70
-
SHA512
ba8d0cf3938f4b9f0044bab5fba3c1f8cf9a65a91586677b75c480c683884b081bcc78216921ef8c68f83af2b0f34241cffaafe04c09fe76b9a5471fa0737518
-
SSDEEP
6144:3K0Z3dwqsNy5ibpNjl4EqxF6snji81RUinKICur:a0VdQxle
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fqdos.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3932 fqdos.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /c" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /u" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /d" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /m" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /y" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /t" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /a" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /o" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /x" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /c" 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /g" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /s" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /v" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /b" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /p" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /q" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /i" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /n" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /r" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /f" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /z" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /l" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /h" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /k" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /w" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /e" fqdos.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqdos = "C:\\Users\\Admin\\fqdos.exe /j" fqdos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2208 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe 2208 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe 3932 fqdos.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2208 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe 3932 fqdos.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3932 2208 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe 82 PID 2208 wrote to memory of 3932 2208 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe 82 PID 2208 wrote to memory of 3932 2208 256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\256a89afbbe4699c228343485e1bbefc_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\fqdos.exe"C:\Users\Admin\fqdos.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5fa3729ac734383d41a88f66081b3f84d
SHA111757a79332e6d4f7e64fe4812b1be4ddf3ef61d
SHA256d250871468a30e878ceb30f151af97edc131db8d817f88bc381ea675a77ffae5
SHA512db8c25fef40b4408cece9bbf068c67da1e92f3fcc80723e9b9cefd8c0cbeae50bf36dd27a195e9bf2db668e4354b6245669895c0764d6599bb78d3eb94523c49