Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 09:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe
-
Size
96KB
-
MD5
2e9be33885ae6c6251c6ae0aa92b31df
-
SHA1
70b2fbb8c6bac7e54e7b3a7e470198feba232ecc
-
SHA256
519d5e3f648ffd89a17ab89de6b1b0a3428e281b2952e67f5c9665be3c1c5ae7
-
SHA512
38041ef8d723d392b5158c82c2a6c24df0b015fb62a9c6db9cd656803cebee4eee7d21b5fb212d1f4d2fcff895057e6cc2d94896d3aa8f64d49f9cb0ab7569b7
-
SSDEEP
1536:eqB2VgzWwmhLmncdkadGVScGYJXeiyCnO+TI4K4I4i404R4Z1VcvsJOpPpMm4/Ns:N2GW6cOadGRJuH7ut/Tdvd+hXV/vU3v/
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ziatiin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3080 ziatiin.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /r" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /i" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /K" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /E" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /e" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /k" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /B" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /O" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /Q" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /Z" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /h" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /M" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /d" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /f" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /X" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /j" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /A" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /W" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /u" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /c" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /a" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /G" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /H" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /Y" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /b" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /P" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /x" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /C" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /U" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /D" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /T" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /t" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /R" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /o" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /q" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /z" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /L" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /n" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /s" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /v" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /l" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /N" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /p" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /S" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /w" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /J" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /m" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /F" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /V" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /g" ziatiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ziatiin = "C:\\Users\\Admin\\ziatiin.exe /I" ziatiin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziatiin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe 3080 ziatiin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4060 2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe 3080 ziatiin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4060 wrote to memory of 3080 4060 2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe 86 PID 4060 wrote to memory of 3080 4060 2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe 86 PID 4060 wrote to memory of 3080 4060 2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e9be33885ae6c6251c6ae0aa92b31df_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\ziatiin.exe"C:\Users\Admin\ziatiin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3080
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD535199177db3b8a71764201a0fcfa2355
SHA1ba8949f126f3de9f953f3cbcdaf1a1466d32c4cc
SHA25668ac77a84963949f8f25a4456d905d2df7dea0ca67db3743736ddb3dc8847210
SHA5127d91fb30e9670d0dd7d675f0f1eaf47da66dadee5c87506c0df725a22927226eebd6944a5dc9075435579077ef9b021d8802d8de6a2308727d952eb1ffdf5196