Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe
-
Size
216KB
-
MD5
88d7ba7286e1be864733a94975d846b5
-
SHA1
bf16920ca627b9673728f026e12c0c9b1d145039
-
SHA256
446403872cf36bf38635ea2e55a555e217e7fb68973bc80f1a890f560b91e46b
-
SHA512
840673ae6949f1f13626eba22108b7f39848f3cff827638e35916193097c50e253a352512fad4fd35dfb754b600592048dcdafc227e7401312b66b89aa1df152
-
SSDEEP
6144:2eUhrbA1x5PZZKnvmb7/D26g4upEoadEXUqgVWLIg7F:AA1x5PZZKnvmb7/D26GadEXUqgDg7F
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deois.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1920 deois.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /W" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /F" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /y" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /H" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /c" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /K" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /o" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /W" 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /i" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /E" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /r" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /O" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /d" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /w" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /g" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /n" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /f" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /C" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /P" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /v" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /u" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /M" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /B" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /L" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /D" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /S" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /p" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /V" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /X" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /k" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /m" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /e" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /Z" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /U" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /j" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /x" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /b" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /I" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /N" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /t" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /a" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /z" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /q" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /G" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /s" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /l" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /h" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /Q" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /R" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /A" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /T" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /J" deois.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deois = "C:\\Users\\Admin\\deois.exe /Y" deois.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deois.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4440 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 4440 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe 1920 deois.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4440 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 1920 deois.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4440 wrote to memory of 1920 4440 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 90 PID 4440 wrote to memory of 1920 4440 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 90 PID 4440 wrote to memory of 1920 4440 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\deois.exe"C:\Users\Admin\deois.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1920
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5ac12d6c82ce1d213c89d46a8cdb95722
SHA168a77e3b13807b6e022ba9182f98d945c0d8a193
SHA256dd90c67964872f4e7eb7c8e5852435c83793cebde7da4756cac5a7422928aeab
SHA51275144124fb98130ab484317807d5d1d390f4f30dd3ef980245379c59aa1cfb7e41c7d2715f79842645ef2ad6e3dc0605b1d464aef99bedef6f27c9aaa912ab41