ddfc81f00cf40069777c5dd30d15dd71c28a59f43df4eef086fc48e54efaa0d3

Analysis

max time kernel
147s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Size

76KB
MD5

fca1a1b6ffc1ab34845901dc5519e845
SHA1

9e2664b5e2d3e0d277939633187d67555576e512
SHA256

ddfc81f00cf40069777c5dd30d15dd71c28a59f43df4eef086fc48e54efaa0d3
SHA512

ac8340a88952aa31047619825303d220283d4caf708f9e80e1a6b5accd31d3a6f4fbe88cd7b22e89baac5a342e65bb543c32f016de85abc7dc5608d888fff022
SSDEEP

768:+embNRqsuhlGOBrhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xk2:Mnqdu3abBGy3G8V0iuo2b

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	niz.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	niz.exe

Executes dropped EXE 1 IoCs

pid	Process
2228	niz.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	niz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	niz.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	niz.exe
File opened (read-only)	\??\K:	niz.exe
File opened (read-only)	\??\O:	niz.exe
File opened (read-only)	\??\R:	niz.exe
File opened (read-only)	\??\S:	niz.exe
File opened (read-only)	\??\T:	niz.exe
File opened (read-only)	\??\Y:	niz.exe
File opened (read-only)	\??\E:	niz.exe
File opened (read-only)	\??\I:	niz.exe
File opened (read-only)	\??\P:	niz.exe
File opened (read-only)	\??\Q:	niz.exe
File opened (read-only)	\??\V:	niz.exe
File opened (read-only)	\??\W:	niz.exe
File opened (read-only)	\??\H:	niz.exe
File opened (read-only)	\??\M:	niz.exe
File opened (read-only)	\??\U:	niz.exe
File opened (read-only)	\??\X:	niz.exe
File opened (read-only)	\??\L:	niz.exe
File opened (read-only)	\??\J:	niz.exe
File opened (read-only)	\??\N:	niz.exe
File opened (read-only)	\??\Z:	niz.exe
File opened (read-only)	\??\B:	niz.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\maxtrox.txt	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	niz.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	niz.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	niz.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	niz.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	niz.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	niz.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\setup_wm.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	niz.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	niz.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	niz.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	niz.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	niz.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	niz.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	niz.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	niz.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	niz.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	niz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	niz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	niz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	niz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	niz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	niz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	niz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2384	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
2228	niz.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2228	2384	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe	82
PID 2384 wrote to memory of 2228	2384	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe	82
PID 2384 wrote to memory of 2228	2384	fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Modifies system executable filetype association
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\niz.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\niz.exe" fca1a1b6ffc1ab34845901dc5519e845_JaffaCakes118
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\niz.exe

Filesize
76KB

MD5
4aed627ad0685b93388bc4ef3fbad3de

SHA1
d9cacef9274b668311c9b24e5c81bd3715a3ac6c

SHA256
c60c99b319eda64d14aef8ba0346f4519216b5364c02de8a254df643774edcc7

SHA512
e705330a155de483306314a757eba886b32f659cee048dc43e23fef0c8da85378e15ff67e4397af1bb4422aed1b533182a3bdf921696f93af1178ffb93653383

Download Submit
\??\c:\windows\SysWOW64\Windows 3D.scr

Filesize
76KB

MD5
6443f0559364f2298deab1ea9a4d155c

SHA1
1055e42e8c0d87d9a90b625fe402b8dd94d82d2e

SHA256
b58bac4e852f8637c2be9c8fb7e0ebcaf6db2f30419928fc3db1856d7fce0278

SHA512
39796d238b8ed8baa7c408cdcd6643a463c886ac90f3ab2227d31dc806ce4c03e3ab2ac8ac4b84a234ddd2b0689c11d3810ad02102b2a75a8b913095dd21a917

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads