Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe
-
Size
260KB
-
MD5
fb7cfb190c7d03c4ae23c230d8598381
-
SHA1
a19daaa619e6ba3b7402580dafb0c7eb7c831bbb
-
SHA256
5a9e7dfa8a27861063e09c0e2c7f2dbf0ae958da9cf0daafe7303fe097f6ecf0
-
SHA512
cd67d3bc9e62a32ea49d4395fd1b031f4c641c0697b01b7dde0a4f6cd3b9d7a9d0ff726de7b3a2ce71921a089458d4ea5f7d61eff7ef32df4c1b28c799256014
-
SSDEEP
6144:x4HXUUp7WQn6mr1R4bKLnXejKloO6JU1J7QnpRZ7Ta9kzU2/pn:xkDp6Qn6mr1R4bKLnXaKaO6O1JApvH
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buaxu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3552 buaxu.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /T" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /y" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /L" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /U" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /D" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /e" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /b" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /q" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /E" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /f" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /c" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /A" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /P" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /M" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /z" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /l" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /H" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /W" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /s" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /C" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /t" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /Q" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /a" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /g" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /I" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /V" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /d" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /O" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /w" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /X" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /m" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /p" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /B" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /N" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /S" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /o" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /R" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /h" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /n" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /G" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /x" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /k" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /v" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /Z" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /Y" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /r" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /J" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /F" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /u" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /K" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /i" buaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buaxu = "C:\\Users\\Admin\\buaxu.exe /j" buaxu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language buaxu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe 3552 buaxu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 384 fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe 3552 buaxu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 384 wrote to memory of 3552 384 fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe 82 PID 384 wrote to memory of 3552 384 fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe 82 PID 384 wrote to memory of 3552 384 fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb7cfb190c7d03c4ae23c230d8598381_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\buaxu.exe"C:\Users\Admin\buaxu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3552
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD568ee29f3661df6dd3035d230b5c7e70b
SHA1c9c9d9314236265407d7615e1702ee76b1f6de48
SHA256ed7dd36cdb58958b500eee24bdc5985b1f29b05b2afcbce10b74d4769296b9d2
SHA512b26713796aafa2a98cffe8cae83ab64b910d35ae14db00d71bbb2981206263601d9176b86d7e3986fb96ef7e656f83dff9a43bf88893d1bc53677e3ca89d7b1f