Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 10:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe
-
Size
248KB
-
MD5
f0e253396c45767a37463b45218c28a6
-
SHA1
bacd308ef5cd16ded856249dbab336cde6ba47cf
-
SHA256
1f26aae05ccb2e2e7fa3718c505a4d0fc5aa143853b679b1af605c10b01819a6
-
SHA512
27a9a1afbfa26432a06b0461bd0c11cf2963ea0e6974df275601a8638a09c2c8fe314511a10046d2015ca2c6957b09ef72cb2eccee160fcd04533c22c9f63f0f
-
SSDEEP
6144:oD06q6Y0d/RCH3erL/sLAsL8fc/UDgKJ1s4EWqZA7Q/DxoI3sDP4QtNINHKbhFJc:X6qh0d/RCHOrL/sLAsL89+AKtF3sDwnG
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fuuuvu.exe -
Executes dropped EXE 1 IoCs
pid Process 2132 fuuuvu.exe -
Loads dropped DLL 2 IoCs
pid Process 2960 f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe 2960 f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /I" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /B" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /l" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /r" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /P" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /e" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /N" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /Y" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /x" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /T" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /m" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /k" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /v" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /X" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /c" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /a" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /b" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /j" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /y" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /E" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /h" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /M" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /g" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /w" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /L" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /C" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /D" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /S" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /O" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /Q" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /U" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /o" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /t" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /H" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /Z" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /R" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /s" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /K" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /J" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /d" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /q" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /f" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /A" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /p" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /i" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /G" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /n" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /z" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /V" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /u" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /W" fuuuvu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuuuvu = "C:\\Users\\Admin\\fuuuvu.exe /F" fuuuvu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe 2132 fuuuvu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2960 f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe 2132 fuuuvu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2132 2960 f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe 28 PID 2960 wrote to memory of 2132 2960 f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe 28 PID 2960 wrote to memory of 2132 2960 f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe 28 PID 2960 wrote to memory of 2132 2960 f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0e253396c45767a37463b45218c28a6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\fuuuvu.exe"C:\Users\Admin\fuuuvu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD549da770390112dcbdf772d35ecf0d5b7
SHA1c06c98c526a0089ba5f0ba038e2f1add0187be75
SHA256e1084e95b613a809d1ad9c4c0afc76af38453377bacb5b24e335e4bf4f6f5cc8
SHA512cc4bb52eeec51dcffee7e3612eee1a2d8e80313e8a21fee03a527cc77ce4c8ea05c73b7277038df468cf9161ee8e4d18b7f3240c53846181d4b44534c1a4ac57