Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe
-
Size
232KB
-
MD5
4b339c507d3bf73c161354f77f1a5be1
-
SHA1
025a4fda1cfaa3d99f979a61df5f43af12f65b4f
-
SHA256
3dba36f6ae6bb74324a5a7800da47b285c199eb208ee0c6162bd91ce531f1393
-
SHA512
88d6c18ae4815875e0561d36162508feb8f28fef7ddde9459859741547a2b6b856e0124e0d9c419ad0dd25f37d541b51b77fec306d73d45ddbc3aee0a0364aa8
-
SSDEEP
6144:8/Q3PFKs78g2KyEOaWEqxF6snji81RUinKdNOv:PPh+mFO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rtteb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1992 rtteb.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /q" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /w" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /m" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /e" 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /b" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /e" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /v" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /f" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /t" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /y" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /n" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /d" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /u" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /l" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /j" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /g" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /i" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /s" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /a" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /x" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /h" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /c" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /z" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /p" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /o" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /r" rtteb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rtteb = "C:\\Users\\Admin\\rtteb.exe /k" rtteb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe 4696 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe 1992 rtteb.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4696 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe 1992 rtteb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4696 wrote to memory of 1992 4696 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe 86 PID 4696 wrote to memory of 1992 4696 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe 86 PID 4696 wrote to memory of 1992 4696 4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4b339c507d3bf73c161354f77f1a5be1_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\rtteb.exe"C:\Users\Admin\rtteb.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD53f7bf9ba49bd3165196e5bd81804bc3f
SHA12dd6ee7e9907871bfbd26f53dc0d19eda52a29dd
SHA2565453682ed0c4d02983ce6ad28e99fb11b0300843abfb52715c78b9a79f20717c
SHA512fa40cc41bd7f762ff90430b10005f736a957d67fed1bc8da02c4cc248c4e2334ce753418511599d6906547823fccfec59ee47e4cd529067a7ec85650d8fd8f4e