Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 12:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe
-
Size
260KB
-
MD5
b37b5c1ce8814e6095c733e5fac921c2
-
SHA1
34865dfdae372bb6061dac7682e690def530ecf9
-
SHA256
030bbc81bad339c77c665d4a51fdd0bd39630c5f6795bf83363414c3d6f749a9
-
SHA512
02f2e5995e408cd5f0c1db2f2dd9d3ccb435041fd3f6cdcd86773aa6d6f6c5a9a5de564332fe9003d46ed4f44168743f858b480b0c40d47e2a361ba51b144013
-
SSDEEP
6144:HdtIgTSrMaIl/jcLijfHFEHWzKvjT85R:HzNTSrMaIqLlImH85R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gikij.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4808 gikij.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /s" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /C" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /Q" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /G" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /y" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /w" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /t" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /R" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /W" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /V" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /o" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /Z" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /X" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /g" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /m" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /f" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /e" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /a" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /A" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /u" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /N" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /D" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /i" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /H" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /n" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /z" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /P" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /h" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /Y" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /p" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /j" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /M" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /F" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /I" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /O" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /v" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /r" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /U" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /d" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /x" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /k" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /b" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /q" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /K" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /L" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /c" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /S" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /J" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /l" gikij.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gikij = "C:\\Users\\Admin\\gikij.exe /B" gikij.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gikij.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe 4808 gikij.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3104 b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe 4808 gikij.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4808 3104 b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe 88 PID 3104 wrote to memory of 4808 3104 b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe 88 PID 3104 wrote to memory of 4808 3104 b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b37b5c1ce8814e6095c733e5fac921c2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\gikij.exe"C:\Users\Admin\gikij.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4808
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD5e39c4a5e0a9cea8975163d34e8551dd9
SHA15dbc3ce6ab1f4e1821697a60f6752df6cbcbb99e
SHA256d3f11838ed6d3f1e5e9719ad43d7df0ff778a9d54c9d451bed3303095666c2e9
SHA512f7ca6a75ea815a3db18902a564f078d5619523493cf7a681fd7f03658d2d76ec61264b4dd0223bbc43d3082843cf17321e423e4363e57a62d03ad32e13951afb