f5ac6d5ec49661b7269ece4edaa931545a7902c767bd91cde1dbc9c8d128bf84

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe
Size

92KB
MD5

6763416d3a5f38070cb64a532f1dc856
SHA1

5bbc6c8e30981ab8b8f74723094435420c4a5bd7
SHA256

f5ac6d5ec49661b7269ece4edaa931545a7902c767bd91cde1dbc9c8d128bf84
SHA512

0e3c765673935688ab283c905b5f636b3ab130164f645ec2ab1a8115ab69a0455a70fc83913b6f0c8563c516979dccf5256de3cff99fe6af5a59044d8bba569f
SSDEEP

1536:tahiOd0FEJ6kri7hwj4Pnv/rvyvJvSvbvfv3yPHpi+a:MhiOdW1mmyPQX

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kuorih.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2400	kuorih.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /X"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /W"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /t"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /O"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /o"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /S"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /P"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /p"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /N"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /H"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /D"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /J"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /y"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /e"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /K"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /V"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /L"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /g"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /f"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /A"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /r"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /T"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /M"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /R"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /a"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /G"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /c"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /Z"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /E"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /w"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /F"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /d"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /x"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /u"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /z"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /q"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /Q"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /v"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /U"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /b"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /i"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /Y"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /j"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /k"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /s"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /n"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /I"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /m"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /h"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /C"	kuorih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuorih = "C:\\Users\\Admin\\kuorih.exe /l"	kuorih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe
2400	kuorih.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3952	6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe
2400	kuorih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2400	3952	6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe	87
PID 3952 wrote to memory of 2400	3952	6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe	87
PID 3952 wrote to memory of 2400	3952	6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6763416d3a5f38070cb64a532f1dc856_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\kuorih.exe
  "C:\Users\Admin\kuorih.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\kuorih.exe

Filesize
92KB

MD5
dea39484e82a160f09e2001ecaf30053

SHA1
b20f24869ca231f79902a9e1d6c2d9f2ba936e16

SHA256
203bfe0b2bd3a8471f65556a082615ebf9eb2ba82a5dacc20b90fdef863dd334

SHA512
ca0b67be4f1f4290fece5c7416fb4ee58007d184d268b60e64f269b0505a1eb76c53162d8a5bfcd5a6e33cc27ac98692d6405964f2689beb3649923daf2465ba

Download Submit