Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:10
Static task
static1
Behavioral task
behavioral1
Sample
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe
-
Size
264KB
-
MD5
366525c0bb1391e1642d3904f6d2565d
-
SHA1
da28048168cbd59b82406fc911d488c9ee9ee3c3
-
SHA256
41c2c0740c7821f19b8d3f492ef37d6f3572386f8f2f8acba7aefb2dae055c48
-
SHA512
0bcc3b3f8664c52918df410702d71c2044e5bd051a42e7ed4763b26f4b6fac046e6fa889d0fd405eb1a2a9f76565eb3ce50ea5f30b3d680c30fd35414a0dd295
-
SSDEEP
6144:ZrrXI/3JJYHyxyIuEA4aZM9DRruwcu3zCCvQe:FrXcvHVzKu3zCCvQe
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exexsqaox.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xsqaox.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
xsqaox.exepid process 760 xsqaox.exe -
Adds Run key to start application 2 TTPs 52 IoCs
Processes:
xsqaox.exe366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /o" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /q" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /d" 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /I" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /p" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /R" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /w" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /S" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /t" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /J" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /U" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /T" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /n" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /j" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /D" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /r" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /N" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /u" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /m" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /i" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /e" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /A" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /C" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /b" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /f" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /z" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /h" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /Y" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /l" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /P" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /a" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /F" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /v" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /s" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /V" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /G" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /X" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /Q" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /O" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /c" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /E" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /d" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /g" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /W" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /Z" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /x" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /B" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /K" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /L" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /H" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /M" xsqaox.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xsqaox = "C:\\Users\\Admin\\xsqaox.exe /k" xsqaox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exexsqaox.exepid process 4960 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe 4960 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe 760 xsqaox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exexsqaox.exepid process 4960 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe 760 xsqaox.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exedescription pid process target process PID 4960 wrote to memory of 760 4960 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe xsqaox.exe PID 4960 wrote to memory of 760 4960 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe xsqaox.exe PID 4960 wrote to memory of 760 4960 366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe xsqaox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\366525c0bb1391e1642d3904f6d2565d_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\xsqaox.exe"C:\Users\Admin\xsqaox.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5299b6cbd0be1077638bc63831547247e
SHA1e792851c6273f1b0e9ab22ccbadddb3b6fee1fa1
SHA256323f4aa6ee3890d27606c174b8a585a5155b3b44122733aaa6044e166dff505a
SHA512ea4085d7b13a98e040bdac86db0ff8191ce371e537a7279b7ec62759684b6d04cfedbcaf2eaab9cf2304933d7719f69fa12b5f463f02f8a994554a1bcb8d60de