Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe
-
Size
228KB
-
MD5
c90d295f1cbc86f8e4557764af632703
-
SHA1
97c79b091c110229df15fa3d200e6b373714aa82
-
SHA256
1c92a3cd490844a55ac2be08e8842ca341f95b8197f40094f86c39764a2d7bcc
-
SHA512
4ea9938547c32a046703e43c2e44255ea4626ae8a08375c5e8882e5d28772d0fce662b43afbb14a0bb65f0955ef457caf4035d9613d648a03a7c2e91aab69a43
-
SSDEEP
6144:Gmb3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/BF:GmLPhAmZIH+r
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" seemef.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4680 seemef.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /w" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /l" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /e" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /g" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /u" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /h" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /t" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /d" c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /i" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /o" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /n" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /a" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /q" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /b" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /x" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /d" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /r" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /f" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /p" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /s" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /y" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /c" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /v" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /z" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /k" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /m" seemef.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seemef = "C:\\Users\\Admin\\seemef.exe /j" seemef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language seemef.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2344 c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe 2344 c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe 4680 seemef.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2344 c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe 4680 seemef.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2344 wrote to memory of 4680 2344 c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe 91 PID 2344 wrote to memory of 4680 2344 c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe 91 PID 2344 wrote to memory of 4680 2344 c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c90d295f1cbc86f8e4557764af632703_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\seemef.exe"C:\Users\Admin\seemef.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4680
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD56bfde5170bb787b50ff9faf35846d84d
SHA1b1a3eec058fbcd92032bad91c7cfd919f92f9103
SHA2566947bd7ad09980ae21ce54918b1cf408d8c1ad43c97a17f15637f2aec20188f9
SHA512064456694bb89f5207ab757a07dde983800d5bef1f167baf97500255f14f5c4429e1699c98b034f50c3074a4d9c4b51164ac256b88cb28050b5b34a3a6858843