Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 15:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe
-
Size
228KB
-
MD5
5c786b024c012b03ea114b4f30a30fa8
-
SHA1
ebb404db099d7aa99bb390cf84dfa5717184df88
-
SHA256
9ca706cc2ff003640f6b98c524832c5d5c876490af0b460f6f95654429004cbb
-
SHA512
0146c252697f02a41e3da9abfde671d6c968b4f7ef278fa1cf9bceb0e252d89252ac151f8f41b22de902c130cc5e73c2626531dd4f10155eac79e537cf7d09c5
-
SSDEEP
6144:omo3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/7S7:omSPhAmZIH+7q
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vgwaed.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3900 vgwaed.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /q" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /c" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /w" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /h" 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /o" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /u" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /d" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /t" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /m" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /v" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /p" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /y" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /n" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /z" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /e" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /r" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /x" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /l" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /f" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /k" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /j" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /i" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /b" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /s" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /h" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /g" vgwaed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgwaed = "C:\\Users\\Admin\\vgwaed.exe /a" vgwaed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe 4544 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe 3900 vgwaed.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4544 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe 3900 vgwaed.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4544 wrote to memory of 3900 4544 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe 91 PID 4544 wrote to memory of 3900 4544 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe 91 PID 4544 wrote to memory of 3900 4544 5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c786b024c012b03ea114b4f30a30fa8_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\vgwaed.exe"C:\Users\Admin\vgwaed.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD50d0014104e602bccf17b3cef9265ebd0
SHA10903f4a6a9987eb697310e6bb7a9aaad98ceb87b
SHA256e3512ec74605091ed554154841783fd14ac86e26c0fcbbbba018db9087453b3e
SHA5123437c16d090dc96f0636e8129f20e70e2f977165e8587dc2685bd00e41e6a0aaee30d366e4d547c388e4455998dbaa13734f5c7b97df6e9e1457894fa20656a1