4a3b8b3cc5c78af971470b45c4e49a7dbf01af80039b7c7db6f6c2913994e235

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe
Size

160KB
MD5

2b22582e7a1387cd7ac75e214049886e
SHA1

01daba3b01ba182f549e28cf9b11afda975e56e8
SHA256

4a3b8b3cc5c78af971470b45c4e49a7dbf01af80039b7c7db6f6c2913994e235
SHA512

35065d53c71c95ae6843567f4c763c0f87e80719beb3458c357845b002a72f2213b3af7271abcec9f0671d8444bd56970dbcb34f3e31950f9f13b2fa92179d47
SSDEEP

3072:Ga5Xf+Dxj95Fbr2IsJ03CwLYwR49hPLd3BzK02Swq4lV34oQZiEh8:z5v+DbbrTw03rLlR4PLnh7w1rZWM

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cairah.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3716	cairah.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /l"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /B"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /y"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /T"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /e"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /f"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /r"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /Q"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /d"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /S"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /M"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /O"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /L"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /m"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /H"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /V"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /c"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /s"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /U"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /D"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /k"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /j"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /F"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /b"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /a"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /C"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /W"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /q"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /Z"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /x"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /Y"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /I"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /h"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /u"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /z"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /P"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /g"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /G"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /n"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /K"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /o"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /N"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /A"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /v"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /p"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /t"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /O"	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /R"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /w"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /J"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /E"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /X"	cairah.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cairah = "C:\\Users\\Admin\\cairah.exe /i"	cairah.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4996	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe
4996	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe
3716	cairah.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4996	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe
3716	cairah.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3716	4996	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe	85
PID 4996 wrote to memory of 3716	4996	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe	85
PID 4996 wrote to memory of 3716	4996	2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b22582e7a1387cd7ac75e214049886e_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\cairah.exe
  "C:\Users\Admin\cairah.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\cairah.exe

Filesize
160KB

MD5
458103ff84be3e57b4c1f228dddefc66

SHA1
2643ed3a5ae8bffcfb8b61c9fb2932e0b92d305e

SHA256
ae20d25cc0926c684b243b9ea5cdec64286aaea1a062f6c5d3c4ffc337e355d1

SHA512
6270158ffe668d58922a1eb27000e200cc902b469b7567970f3afac62520e89cc8523c173ce67fb533244ebd01939fae507286ef89c884791849df14aa63661c

Download Submit
memory/3716-33-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3716-38-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4996-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4996-37-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download