Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe
-
Size
240KB
-
MD5
d124ef767c64284dfd31e1df02b6f09d
-
SHA1
0561881c329f1dd2cb6f05e278db14d1de518973
-
SHA256
ce4e4c7ec2c3c2611193c68a6d83b35a74c323ef72bb8d06baf1af27caf4b324
-
SHA512
27a3bde86d457af525abece1a25a7a6f9822b065c224e0f7590867c391196889d72a01cacf60ac372a5c6718eeabe004e6e16fc212f113c42e93f9bbaadbccc0
-
SSDEEP
6144:DUz3dwqsNwemAB0EqxF6snji81RUinKchhyZS3z:GdQQJsAj
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fqtauf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2880 fqtauf.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /w" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /h" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /k" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /o" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /b" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /j" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /r" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /x" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /d" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /g" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /p" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /c" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /f" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /n" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /m" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /s" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /y" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /i" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /l" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /a" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /q" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /t" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /v" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /u" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /e" fqtauf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /i" d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqtauf = "C:\\Users\\Admin\\fqtauf.exe /z" fqtauf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fqtauf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4144 d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe 4144 d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe 2880 fqtauf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4144 d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe 2880 fqtauf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4144 wrote to memory of 2880 4144 d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe 91 PID 4144 wrote to memory of 2880 4144 d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe 91 PID 4144 wrote to memory of 2880 4144 d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d124ef767c64284dfd31e1df02b6f09d_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\fqtauf.exe"C:\Users\Admin\fqtauf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2880
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD504d34fb3712b5bc894202d3238061015
SHA1e480c296ab8c53fdf05582e72cd0e42ebda1d91d
SHA25655a851749ba5dfd93fd529dd826f17f0d625fe96f4b2bd895d1388e2d25577b6
SHA51242153dd0d0a16776ef7f4c0decff69598cdd928e6ee34d15bfd16132e8e90590aa382ed9bafa90a081b636910935933d8adf2fd122bfa02e93dc7cb33d3fcd41