Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-04-2024 14:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe
-
Size
256KB
-
MD5
eda8b5f3e378fe847e0580e205eb33fd
-
SHA1
f833ebe6a1e3bf312fc1ac1974115d2d49ca9490
-
SHA256
46f7f4ef8cace4c42fd6659c5a735a7dde4f13cc7494ca17e2a9f3e96208c9a1
-
SHA512
77e9cea8d7bd13de670a5009e00ff2e0097a069a70921986abee671f5298532f734ee33c7293a04db7ab2578c90264e7b60de4bbe76dfd08b1d0db8f1fd7532a
-
SSDEEP
3072:x0bfWRrIMNRlZ62Pal2LBJXmzOHm5WZ3K+MCBOQ39cOaRr5ZGPVB:xWepp3PJXCOGY3egOQ39cC
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nzfoux.exe -
Executes dropped EXE 1 IoCs
pid Process 2516 nzfoux.exe -
Loads dropped DLL 2 IoCs
pid Process 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /e" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /n" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /t" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /w" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /i" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /b" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /x" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /h" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /d" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /m" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /v" eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /p" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /z" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /o" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /c" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /a" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /q" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /r" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /v" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /y" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /u" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /s" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /k" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /f" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /g" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /l" nzfoux.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\nzfoux = "C:\\Users\\Admin\\nzfoux.exe /j" nzfoux.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe 2516 nzfoux.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe 2516 nzfoux.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2516 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe 28 PID 1308 wrote to memory of 2516 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe 28 PID 1308 wrote to memory of 2516 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe 28 PID 1308 wrote to memory of 2516 1308 eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eda8b5f3e378fe847e0580e205eb33fd_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\nzfoux.exe"C:\Users\Admin\nzfoux.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5d610dbd778baa6a1201d5a4339f0c72d
SHA155ebb29bbf5755cead9c37cafa10414d60166067
SHA25608c4d856e67bbc1d1016bf096795d015db8c3a7617013334d4556e65e0b57469
SHA51247c0a86a28e9c90d490e8d1f51eda431ccf0f96f042f5ec7d6eb19020ce408a101a4f168164023e6b93d9802e61d33a0a92cad91c967d50766a862b47dd9fe8b