Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 22:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe
-
Size
296KB
-
MD5
b55ebe8f55071f1fb0f701f2cd67a931
-
SHA1
33d5278b7f6505611964a8aa9311d7f1887e76e0
-
SHA256
02e94582fc90e58e8ee2d8c78135bde6aeb9daab7a75222d0c87c926a4edfe9e
-
SHA512
31f0c0b97f5ac93965e6f29e6909f8552ca2287bd34db4c9861d3fc62f56eb34fea2b0b04d5b7314b221344410fe968c126101a388162d44617bbd827683de1d
-
SSDEEP
6144:IkynD1y0FXrKnvmb7/D26OJYPsMiqDJlJNwHG6s20EBb4jHX3QA/hwNGhWhThPvL:IXD1y0F7Knvmb7/D265DJlJNwHG6JTbk
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ziiyu.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3272 ziiyu.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /L" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /u" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /B" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /m" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /S" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /P" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /C" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /y" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /E" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /J" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /t" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /o" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /c" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /z" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /R" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /g" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /A" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /h" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /I" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /Q" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /F" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /a" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /w" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /K" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /n" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /Z" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /W" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /Y" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /e" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /k" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /Q" b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /D" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /T" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /j" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /i" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /V" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /b" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /X" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /H" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /d" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /x" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /U" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /l" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /N" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /p" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /r" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /v" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /O" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /M" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /f" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /s" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /q" ziiyu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziiyu = "C:\\Users\\Admin\\ziiyu.exe /G" ziiyu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziiyu.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3864 b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe 3864 b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe 3272 ziiyu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3864 b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe 3272 ziiyu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3864 wrote to memory of 3272 3864 b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe 92 PID 3864 wrote to memory of 3272 3864 b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe 92 PID 3864 wrote to memory of 3272 3864 b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b55ebe8f55071f1fb0f701f2cd67a931_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\ziiyu.exe"C:\Users\Admin\ziiyu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3272
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5d8438fcf021ead54d2593afe2c636680
SHA12c06eaff522b5f1b854fd198b0715bfab5b96c61
SHA256eae2cbda131c2f517fc7195e142131d6c036d6bfd202e0f77d1c2898a6462d91
SHA512dd9a0ab6ddb7c852adc5b593a5395043152a8144232da50614bdf2cdf40427dffe7f3160ec7bb4662de0a7ba702172c7a85a29c6b1d4b95a2baec964b8bcc50b