Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 03:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe
-
Size
264KB
-
MD5
5a56396b45f0d8501d87daa8cd425996
-
SHA1
d24c157a032d2cba1e4c2ca6ea53c8a3c16d4988
-
SHA256
0296bfca8e537b1293a767a782a8e69c8b1c9ca066bfacc62d4240eafc1156ee
-
SHA512
09405836c748680980ae99c6ddd2c52de72a33718aa63fe0543779fa75d84ab3154993cd7e544b8167a8acf92bbdbf40a66f4eebc3a34b26e6e6c1a762bbb579
-
SSDEEP
3072:HwwQcqsOeP+2IDyG2pfr4GNLzECcKIvMBSYWunCvPQiwhjXH1WkaBx5/lvnjLYar:QwQ3sOem9Ic6OLynWunzXH1W9r
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" noaaboc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 5012 noaaboc.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /Q" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /r" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /N" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /A" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /S" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /E" 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /e" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /g" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /q" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /Y" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /p" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /n" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /b" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /z" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /a" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /c" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /m" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /u" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /d" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /f" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /U" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /R" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /Z" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /M" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /L" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /V" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /W" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /o" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /G" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /s" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /H" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /J" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /x" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /w" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /j" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /C" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /v" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /E" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /k" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /B" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /X" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /t" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /F" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /P" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /T" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /I" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /i" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /D" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /K" noaaboc.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noaaboc = "C:\\Users\\Admin\\noaaboc.exe /O" noaaboc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1352 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe 1352 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe 5012 noaaboc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1352 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe 5012 noaaboc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1352 wrote to memory of 5012 1352 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe 87 PID 1352 wrote to memory of 5012 1352 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe 87 PID 1352 wrote to memory of 5012 1352 5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a56396b45f0d8501d87daa8cd425996_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\noaaboc.exe"C:\Users\Admin\noaaboc.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD531e9f3d62fba6b9bf6065541c24eeb41
SHA1f8886ae3370c2512d694971c94bb6268e41b87c3
SHA256c31e973acfc4cfceaba6a5a04bc13487bc768fab7b956e14d7129c803734f390
SHA51229ae345917e6ed2f9be79ba14d11a144281c2ebe965c7ebb914b0916771efed329174d63ebbd4f1163684f723ff7f037c043ba33f09fda8910ced914456882ce