Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 19:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe
-
Size
96KB
-
MD5
a7d6ad4f4e4b1f46c1920a97ef09e2cf
-
SHA1
53730e3f610495d83e5a21683f8e8899ec8e68e7
-
SHA256
45b86bf9da4b73b45905264606851b13c30b894e636bcdbb84e3a282f1cc01e0
-
SHA512
6a2e17154ab096f7228ecd325df2cdc149dea89bb4e1972719b9fa3ee32f3c00a06e82e0aa02ee0aaba8084daf0587c929e3e8ef99b8f09ca2b5d811d22ae4a0
-
SSDEEP
1536:P9xEg52u9tyVQO8P8ychJXwjj3RJNEo/knRzdnynE7RldNEP8lijOe/NIjnZy2:PXE/uelychJ6zR3Ek65Rldq/CnA2
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beeaga.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4548 beeaga.exe -
Adds Run key to start application 2 TTPs 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /L" a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /j" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /Z" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /n" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /f" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /z" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /P" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /b" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /a" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /I" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /D" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /h" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /N" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /d" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /X" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /V" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /w" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /Y" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /o" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /k" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /J" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /r" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /v" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /O" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /F" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /A" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /y" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /M" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /m" beeaga.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beeaga = "C:\\Users\\Admin\\beeaga.exe /c" beeaga.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beeaga.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2064 a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe 2064 a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe 4548 beeaga.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2064 a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe 4548 beeaga.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2064 wrote to memory of 4548 2064 a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe 92 PID 2064 wrote to memory of 4548 2064 a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe 92 PID 2064 wrote to memory of 4548 2064 a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7d6ad4f4e4b1f46c1920a97ef09e2cf_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\beeaga.exe"C:\Users\Admin\beeaga.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4548
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5b779aa431ec5e85a40d9ce4abf89b2fe
SHA1131d580a3dcb18a61ad79216fa3405ec7ab75260
SHA256161f894c5c6b6d3e759741baaef564c0d8ae90ee4a0c84212fcae7e8f8324456
SHA512b14766a2bd8c3cb044beb6ba9a23440b5b018ccd0fb1f6b976bd526044db7897831e2896773fce066da4c2c3574b2fabbc34ab800d9174e9b4a27b0f0bc0d683