40fd9d7eb14df4a1d1c8fadddfaf49e9b430c36f8d2e88425bef65b5d2e1c6d4

General

Target

36658031885947b34da48b909a6297f2_JaffaCakes118.exe
Size

100KB
MD5

36658031885947b34da48b909a6297f2
SHA1

714e3b6a17adc6e78ad5c78350ef09bff4a6f435
SHA256

40fd9d7eb14df4a1d1c8fadddfaf49e9b430c36f8d2e88425bef65b5d2e1c6d4
SHA512

a202cd485b8c33ee7bdc56e7e954a675c288d070020705247484e99b16bb2f312d3e713e82af2dcfedb75dde3a0a89130f7ad604ce8bfc19f17fa478b8d65f4b
SSDEEP

1536:dttGG82NTzw5MGAc4ohrPXo+73Rez8b0SyKNIjnZrJ:lwgurPX7CKCnlJ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

36658031885947b34da48b909a6297f2_JaffaCakes118.exedaxec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	36658031885947b34da48b909a6297f2_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	daxec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

36658031885947b34da48b909a6297f2_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	36658031885947b34da48b909a6297f2_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

daxec.exe

pid process

1028 daxec.exe

pid	process
1028	daxec.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

daxec.exe36658031885947b34da48b909a6297f2_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /n"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /I"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /f"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /q"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /j"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /m"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /p"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /x"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /P"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /a"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /K"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /C"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /J"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /t"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /S"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /d"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /X"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /O"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /b"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /e"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /G"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /D"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /c"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /Y"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /u"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /l"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /B"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /W"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /R"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /s"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /w"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /F"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /z"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /r"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /y"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /Z"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /T"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /U"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /k"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /o"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /H"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /v"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /i"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /A"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /h"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /V"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /N"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /M"	daxec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /C"	36658031885947b34da48b909a6297f2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daxec = "C:\\Users\\Admin\\daxec.exe /Q"	daxec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

36658031885947b34da48b909a6297f2_JaffaCakes118.exedaxec.exe

pid	process
2636	36658031885947b34da48b909a6297f2_JaffaCakes118.exe
2636	36658031885947b34da48b909a6297f2_JaffaCakes118.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe
1028	daxec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

36658031885947b34da48b909a6297f2_JaffaCakes118.exedaxec.exe

pid process

2636 36658031885947b34da48b909a6297f2_JaffaCakes118.exe
1028 daxec.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

36658031885947b34da48b909a6297f2_JaffaCakes118.exe

description	pid	process	target process
PID 2636 wrote to memory of 1028	2636	36658031885947b34da48b909a6297f2_JaffaCakes118.exe	daxec.exe
PID 2636 wrote to memory of 1028	2636	36658031885947b34da48b909a6297f2_JaffaCakes118.exe	daxec.exe
PID 2636 wrote to memory of 1028	2636	36658031885947b34da48b909a6297f2_JaffaCakes118.exe	daxec.exe

C:\Users\Admin\AppData\Local\Temp\36658031885947b34da48b909a6297f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36658031885947b34da48b909a6297f2_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636

C:\Users\Admin\daxec.exe
"C:\Users\Admin\daxec.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\daxec.exe

Filesize
100KB

MD5
ff1158fd702136e717c27d4c76bb6864

SHA1
7284764e2b140b0ceacaea819e35bb07ad06cece

SHA256
7b1b7c8b19043d6094b89d0b9960d8dde22c24af4e75c31946cea0c2c3efba4f

SHA512
0317cbb2d2503f90e271722a7d27d908362d1c8c4200924e4668edeb41bec4efa086c9fd0d8b9042cf68844c22d653f227a2b2db15aacf2b8f9ba035e2b58daf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads