Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe
-
Size
100KB
-
MD5
4c9699cf08d3e89ada3d26b4c754019d
-
SHA1
472955c0fcaf59471649152aeb08a2e79afed7b8
-
SHA256
675d854ebc2bc1424e4dc42c928ecaf0f419dd101d30c3a227c68f1858cce8f4
-
SHA512
c71d6951fa4a943b7b16f7289262d857edfbc8b2eba1bbc1ebd9636a88cc41de9356a71a1207c732881dbf46b9794a940a38d4c16726f5d277cabc0b69ef824c
-
SSDEEP
1536:/Gt0Q82NTdwgLGZcYADZPU1+73BD88b0nysNIjnZq:uwXgZPUQJsCnY
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" suiewe.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1156 suiewe.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /x" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /V" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /a" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /M" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /O" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /C" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /g" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /v" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /m" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /H" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /A" 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /i" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /n" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /b" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /h" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /w" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /I" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /K" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /N" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /X" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /j" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /R" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /L" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /f" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /u" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /B" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /e" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /S" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /Q" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /P" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /o" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /q" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /T" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /U" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /d" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /Y" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /c" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /y" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /A" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /r" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /Z" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /s" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /z" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /l" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /G" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /W" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /p" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /F" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /k" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /t" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /D" suiewe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suiewe = "C:\\Users\\Admin\\suiewe.exe /E" suiewe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe 2692 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe 1156 suiewe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2692 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe 1156 suiewe.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2692 wrote to memory of 1156 2692 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe 86 PID 2692 wrote to memory of 1156 2692 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe 86 PID 2692 wrote to memory of 1156 2692 4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c9699cf08d3e89ada3d26b4c754019d_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\suiewe.exe"C:\Users\Admin\suiewe.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD539b17c3add0cc948ec68cd0890d44e02
SHA184105cea957fdfdccf86c251449a8f3923b89636
SHA2568eae3221b521a245c1d581c5595499dbce724a784e513c227f9ac73245f2db11
SHA51224970f3a229b5bd7335d201cc2412ab34c7a8bda1a28e9ea52532deebb985eaeb0692ceaa97624d5143082d26583fbc67d6a45430d12ec3d174117c6ee6bf0aa