Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16-07-2024 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe
-
Size
264KB
-
MD5
4cb349def836d1a4539574d1195334e2
-
SHA1
770261064c4fd0cf9c550fcbd42d196944d6ee52
-
SHA256
7845580f04178f737b84741aecd73b17dcdfe88898aa3956b7b7b2ec3f338860
-
SHA512
48de2011962b1fceb6f6b2cca8115bbd6f16029254c6c0866fba0c69cf66eba0da6942fc445b3ea94ac5f75aad998f5548a0208730f61e7e3a19ef47f150b753
-
SSDEEP
3072:nM1YUuGGHGm4vhj72fcoV39N82Xph9InbDWAqWAdwwsJf8EV3JAJDSPCpH:nMGGRI180MGdddEsJDSKp
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jaivou.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1488 jaivou.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /b" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /L" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /O" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /M" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /N" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /I" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /U" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /D" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /t" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /y" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /x" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /H" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /q" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /Y" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /F" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /w" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /d" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /o" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /Z" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /j" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /E" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /A" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /W" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /v" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /m" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /z" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /X" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /f" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /K" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /i" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /C" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /n" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /T" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /e" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /p" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /S" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /a" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /l" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /k" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /Q" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /c" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /R" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /J" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /V" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /g" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /P" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /r" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /G" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /h" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /u" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /B" jaivou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaivou = "C:\\Users\\Admin\\jaivou.exe /s" jaivou.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe 1488 jaivou.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4512 4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe 1488 jaivou.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4512 wrote to memory of 1488 4512 4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe 86 PID 4512 wrote to memory of 1488 4512 4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe 86 PID 4512 wrote to memory of 1488 4512 4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4cb349def836d1a4539574d1195334e2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\jaivou.exe"C:\Users\Admin\jaivou.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD59a4b9d1d8b28117b1b5534b492785262
SHA1e5496e93c9b6f0513ac663bbadc44855bf46e224
SHA2569ecf203002cee0db2c0051ba1d6af1ec2ab9ae0c3f4d60ed5dc92f660fcb3496
SHA512d987f59c7cb09f4e197fbcd3b97159e2765ad2c9f485eaf2c8e763e4fa20b1ced569e42e51d08741f37629d1148808a094616479a14d26ff6f2d0a125404c8ff