Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 05:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe
-
Size
364KB
-
MD5
84f685fbce0bb373d4ac2b6ac25f625b
-
SHA1
2309f13bdf6cba92307fff7fafc4a6c7bfb2f451
-
SHA256
14c100f93ab5e8dcaaaca7d21bf2abfe4ac45e25eb5252bda224787161fdcdb9
-
SHA512
1c5857a19fab4dcb239394da5c50da9512e8613eac911eaf540be0d156ee2a709e3a79e6bc5ea2f900e4d7be92e3174b6ff2e6cd9c5e08c421333db65116edff
-
SSDEEP
3072:+YGAiXP9oJuGEnvB7HplTOoX56B4uE7U4iy+LwldhzNkYMvMZqvRU36toRG9DOsS:y9GuPnvBbxYJxwphkYMvMZ0DO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeoami.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 836 zeoami.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /o" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /d" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /t" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /v" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /u" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /h" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /f" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /j" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /q" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /e" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /y" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /r" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /l" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /s" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /a" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /b" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /i" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /p" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /z" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /g" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /j" 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /m" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /x" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /c" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /k" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /w" zeoami.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeoami = "C:\\Users\\Admin\\zeoami.exe /n" zeoami.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zeoami.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2664 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe 2664 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe 836 zeoami.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2664 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe 836 zeoami.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2664 wrote to memory of 836 2664 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe 89 PID 2664 wrote to memory of 836 2664 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe 89 PID 2664 wrote to memory of 836 2664 84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\84f685fbce0bb373d4ac2b6ac25f625b_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\zeoami.exe"C:\Users\Admin\zeoami.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:836
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
364KB
MD56d1d6aa3fe1202098b41ce8db7eb8c50
SHA12ccaaf991674777498bacc0b3477baa3a09604fc
SHA256bc9d2e2480027eeb9f087477f952e2dc78e854d59ea3e831290008cc2a3df989
SHA5126790f189d2c19792e4234f56810c60a60b8127ef1312e43809490983d3a9c1145e96de38ffcefc971eb44d33e2fe9f56ffe9faa3c46dbac7192b2e3e69a8487b