Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe
-
Size
232KB
-
MD5
0665e9b0ecb240976c8c1e6f9d39316b
-
SHA1
7c41693145485b93ee8b29cac22f943fca2ba368
-
SHA256
88d36b522bd9178718e5e6b219f9ea0818588f4de52ac4b4fc10b83dc2fe9850
-
SHA512
05b9df5f41319c1e887d8d052df098966304f0529416a3faeb0f283fc369964a85cd538e2ee281b3c42fd4799a392230cf0123ea97a88b82a76044e1c6cca954
-
SSDEEP
6144:b3PFKs7diixRSFBfWEqxF6snji81RUinK51jbkxkubS3:LPhJuBXVbkxJb6
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" heiyoug.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3204 heiyoug.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /w" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /z" 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /n" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /i" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /m" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /x" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /z" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /h" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /b" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /t" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /u" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /r" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /o" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /v" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /q" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /y" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /g" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /f" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /c" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /l" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /e" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /d" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /j" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /a" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /k" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /p" heiyoug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\heiyoug = "C:\\Users\\Admin\\heiyoug.exe /s" heiyoug.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language heiyoug.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3192 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe 3192 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe 3204 heiyoug.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3192 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe 3204 heiyoug.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3192 wrote to memory of 3204 3192 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe 90 PID 3192 wrote to memory of 3204 3192 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe 90 PID 3192 wrote to memory of 3204 3192 0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0665e9b0ecb240976c8c1e6f9d39316b_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\heiyoug.exe"C:\Users\Admin\heiyoug.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3204
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD56b4870c6ff1bf20bad879cf3686d90af
SHA169ea9bf774e01ff56b012e2278b20526f912ab2e
SHA25663c005f6f216d6bbf6aacd595b320f1447be1fea4dbfb47603e23045bd8803ab
SHA512ed6a1699512d8c90e2bc9cfa61560017d6c7d04b00ac4a83875b7c6b8e4392deb5088f5c2e834d3d2291a65388e13e85f8d93726e12aaa0c5da91e2af906c63a