Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 07:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe
-
Size
312KB
-
MD5
5fa69382663f97d8d35db3511e1d6a84
-
SHA1
6ff472e442d12fcd8a3034d9fb6b0a60595cdab1
-
SHA256
62caab95c8140f02fa2a2e73ec71b23cfde73aa341bd6c337fbba0a07712c6b4
-
SHA512
0237db4f82e8de1f0428485232efba1d6e8f13f458e95c7666703f5627ac9ec7929a5804a9d2aef5dae0ab384321501037d0b0cd96cec7d7d1afae0a56f5dbb1
-
SSDEEP
6144:M0JI/XpSuhRjAfpVzs+txf3myzc9f35Q67l1tR0CugEv5C3q:XJ+XpSuhR0fDs+tUsc9f3b3BrEBM
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reeaqor.exe Set value (int) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 860 reeaqor.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /T" 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /b" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /A" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /l" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /x" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /I" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /M" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /R" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /W" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /m" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /Z" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /N" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /f" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /V" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /u" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /O" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /h" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /J" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /v" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /Q" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /r" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /z" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /D" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /y" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /k" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /X" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /P" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /G" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /c" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /p" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /n" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /T" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /a" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /U" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /F" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /s" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /E" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /w" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /K" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /g" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /o" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /Y" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /j" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /H" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /q" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /L" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /t" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /B" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /i" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /d" reeaqor.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reeaqor = "C:\\Users\\Admin\\reeaqor.exe /e" reeaqor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 680 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe 680 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe 860 reeaqor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 680 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe 860 reeaqor.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 680 wrote to memory of 860 680 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe 91 PID 680 wrote to memory of 860 680 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe 91 PID 680 wrote to memory of 860 680 5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5fa69382663f97d8d35db3511e1d6a84_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\reeaqor.exe"C:\Users\Admin\reeaqor.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD552c5af3ca754cfd70864798c2d01a568
SHA1f012d45701a45511207c444e0fe9688288ef4eff
SHA2565abcb148f380f01559d48dc77e2704101a4fdeb7edf69c390e1727c42285271a
SHA512e50866781507639ab9df291ea1deb08bd4d385b456aa34ec14a9373d9f12639a52cd2863d795ca7e28157f1e207929989d5c2c1ba0a5535effb6acd5b38a54f1