Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe
-
Size
220KB
-
MD5
dc60f65b194154c82c4e4a9c0a010a64
-
SHA1
8ea3701e74d70b5d7c18f52255d164a15d7839ae
-
SHA256
0f63fbc2008ec12ec8ea49c72c323bb0aecb96cf94de1e171ba5b5dd1a3a049b
-
SHA512
16e092ecd8c1c6b314e9553cd7e7f8172ab8f89ad42b4708646f91b6aec3f9ccbfdc56dd07f205f1c1911b87cecc4cfc17bb605ac5008c02e9d89c6a20f7be07
-
SSDEEP
3072:yQqwTpkJ8YUL4qx9RIHgil3UuhSa3U3dDpd6Oy+MIrnj3JhNcW:hNVkS15x9SHVe1jZ5
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pegov.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3208 pegov.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /b" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /j" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /w" dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /w" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /n" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /q" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /d" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /t" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /s" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /c" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /p" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /r" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /x" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /y" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /f" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /h" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /m" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /u" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /o" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /a" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /z" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /e" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /k" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /l" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /g" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /i" pegov.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pegov = "C:\\Users\\Admin\\pegov.exe /v" pegov.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pegov.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 624 dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe 624 dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe 3208 pegov.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 624 dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe 3208 pegov.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 624 wrote to memory of 3208 624 dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe 89 PID 624 wrote to memory of 3208 624 dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe 89 PID 624 wrote to memory of 3208 624 dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc60f65b194154c82c4e4a9c0a010a64_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\pegov.exe"C:\Users\Admin\pegov.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3208
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD510a6f13adee6040b56b6ab5a08d98b8b
SHA17eccb31458f804f59ad0d7f8071dabfa2b2940d6
SHA256b3cbc6e345359ea8c51efd1f8365a7da6d773341d688d0fb79f80794b176184c
SHA5128a0f23678efda90e1d2119db228169529f040e0d37d527a56ffab5ae45a4dd28faa0f667bc4655bdd1edf8d5cd3dcf59c043998615e49bbee5020aad4cd5c33f