Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2024, 07:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe
-
Size
228KB
-
MD5
4d7015aa8f495f7023eb7d12a677cff5
-
SHA1
a9f41214c0b1c3a86c355832b63be433b36c0a96
-
SHA256
36b883e255d3682a5a4b5bf1f936a26871329085c8ac846d6362d70c58a0ce21
-
SHA512
692a15188445f5b3c6330f2ac50a1bc1fafddf4b10ec33e2df2be67f79bd604f8e72b1226d32cb03561773d78fa91157a91673c8c806911b8ffe3605c29b010b
-
SSDEEP
6144:OuaJEFDFY0ph7n2/2Z5ie1O34lyzOWJz/zImABhU:OuaJEBO2lDZ5z1+zOWJzks
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beoivu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4112 beoivu.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /H" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /h" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /G" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /Z" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /e" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /A" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /P" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /j" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /L" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /t" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /s" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /W" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /I" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /m" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /z" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /M" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /D" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /x" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /Q" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /l" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /c" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /f" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /V" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /S" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /B" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /E" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /p" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /v" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /i" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /q" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /k" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /a" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /C" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /g" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /n" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /u" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /N" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /O" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /R" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /K" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /F" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /r" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /Y" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /X" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /w" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /o" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /y" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /T" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /J" beoivu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beoivu = "C:\\Users\\Admin\\beoivu.exe /U" beoivu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe 4112 beoivu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4400 4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe 4112 beoivu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4400 wrote to memory of 4112 4400 4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe 86 PID 4400 wrote to memory of 4112 4400 4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe 86 PID 4400 wrote to memory of 4112 4400 4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d7015aa8f495f7023eb7d12a677cff5_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\beoivu.exe"C:\Users\Admin\beoivu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5bae5de249b4e9fe08d2c29afc7376fe1
SHA1f25fcbda10315d92c58a67fd38c7ca0bcbbdb962
SHA256aa3132a44384d0793dfc3ab94f9d3eab868a0bc8bd2ccb82e445044c6fee0925
SHA512067f2b1e034e403d9a72addff0f3d4fa436cadd46ea6a8b07dbcf1225af3ecf8fbb43493054a50befc25f5a98daaa6180fb7df72a45c1256f173c3fb52ed16b0