Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe
-
Size
156KB
-
MD5
bfd3defede8466d96d406e57cb6a1da8
-
SHA1
3776ff7292276ce1f2077239afd6bcac07f0b649
-
SHA256
9fdaca6686fc5a06bffe629900ef0a79bd0eb5e5da2126d5b6df6c7bf1cca61f
-
SHA512
08d1868bde3589b616c2127369c7305647fc05fb088116bd958b49451bf2aee85f3873ea6cee7951be09faf360a109c9be6f5224ff471ab43662374c756a44de
-
SSDEEP
3072:kUf172L2wmM39vJhjmRMKGOMztubDqrmhX1yjdLiXE5j4oQJ:Bt22wmMtRfXZm1gpZd
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beaceud.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3520 beaceud.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /O" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /A" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /b" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /E" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /K" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /W" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /a" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /J" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /p" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /e" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /C" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /q" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /Y" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /G" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /P" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /I" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /d" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /L" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /T" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /H" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /t" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /k" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /m" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /r" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /i" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /y" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /U" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /S" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /v" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /z" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /g" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /M" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /N" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /D" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /b" bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /X" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /u" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /Q" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /l" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /f" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /w" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /Z" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /B" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /x" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /o" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /c" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /F" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /R" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /h" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /V" beaceud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beaceud = "C:\\Users\\Admin\\beaceud.exe /j" beaceud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beaceud.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 5032 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe 3520 beaceud.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5032 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 3520 beaceud.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5032 wrote to memory of 3520 5032 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 90 PID 5032 wrote to memory of 3520 5032 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 90 PID 5032 wrote to memory of 3520 5032 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\beaceud.exe"C:\Users\Admin\beaceud.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3520
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5b44e92a61465489d9d7f3c02ba8a91a0
SHA13b9011f009cec4c5ef04efc0b9f568a258d48183
SHA2562a104cea90e02053b7b8f5151725f63cc664e9c723ba982341fbce12787c33d0
SHA512288dfcc9ecf5d312a73f7762f8c5a00b9bc2938268d1d0dd2df14e4c0822fcca04b5110fe11f63565ee08d28fc4bf38b64546f903f5c417bbab0d07b13aa24bb