Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe
-
Size
96KB
-
MD5
d1feb210a44695ae30eea9523608b6a2
-
SHA1
9d3ac2c26efba527c3f2de66641002cea35567ae
-
SHA256
14e2f59d42143ebfe3eb19114822d919fb6dde3fd6c63553951e1d637682431b
-
SHA512
0129912e1934b58e9ad5be96c16e0f5a97513a39e95ebd09b86ca19dc1b4bd50fe04956c99d48f33b6ef906c85cd4e03386900f0e0277b104845ae3401470cbd
-
SSDEEP
1536:GWQBHKf6cO/hjkGulSc16l6u+NMMl/KlYv1Tq5ThFfNIjnZ+F:yJhslu8CFFfCnwF
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hoaekuy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4920 hoaekuy.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /Q" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /S" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /Y" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /v" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /x" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /t" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /g" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /s" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /V" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /E" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /f" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /l" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /b" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /c" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /r" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /n" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /X" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /J" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /e" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /A" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /z" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /M" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /W" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /U" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /y" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /K" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /q" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /o" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /Z" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /h" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /j" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /i" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /m" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /G" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /O" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /D" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /k" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /d" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /N" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /T" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /a" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /F" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /C" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /R" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /u" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /I" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /P" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /Q" d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /w" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /H" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /p" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /L" hoaekuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hoaekuy = "C:\\Users\\Admin\\hoaekuy.exe /B" hoaekuy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hoaekuy.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1068 d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe 1068 d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe 4920 hoaekuy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1068 d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe 4920 hoaekuy.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1068 wrote to memory of 4920 1068 d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe 87 PID 1068 wrote to memory of 4920 1068 d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe 87 PID 1068 wrote to memory of 4920 1068 d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1feb210a44695ae30eea9523608b6a2_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\hoaekuy.exe"C:\Users\Admin\hoaekuy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4920
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5013366f275545b6afbc1f2396ded6d17
SHA1ca708ca19c6a68c3f9b645370170573b7a974501
SHA256fb3925a9153a80c86348cc1e3871717989b2cac082c1812392344274cef31b92
SHA512e8c761dcadbc9ec98059950b0f3e718fb6a20c0df37cfaa7c7a1a7c028daf8fac07e86cd0e1e36634543263b327b86bd7ee4f47c9674229e6f14f4d5dd73fa88