Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 07:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe
-
Size
252KB
-
MD5
f788eb00ea4172250544e956e3742aee
-
SHA1
9e9673a0c1ed100c2f6246449005ecfe781da512
-
SHA256
f0e5e508382cb532b7d6468a1757774c3c5bdd7a3e6769d31a8e2640fc82aae5
-
SHA512
25258bb4c7956a83cd3c625b919ca22eaf413e8dba3d9f76dad59156203654cb916db448e71db269fcdf52ece91eeb222de7ce745cabc3224b71df0cd4aaa3c9
-
SSDEEP
6144:tWABBNK/8AzzCnU+26MquK5MTN/RI2UvDL:txA/84WmlV
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" haesik.exe -
Executes dropped EXE 1 IoCs
pid Process 2724 haesik.exe -
Loads dropped DLL 2 IoCs
pid Process 2292 f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe 2292 f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /W" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /c" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /O" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /o" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /V" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /G" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /d" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /B" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /I" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /m" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /U" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /E" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /A" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /f" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /Q" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /i" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /g" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /K" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /H" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /n" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /X" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /P" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /k" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /z" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /a" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /M" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /v" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /s" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /p" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /Z" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /b" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /R" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /l" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /T" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /S" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /J" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /F" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /y" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /Y" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /q" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /r" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /t" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /u" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /D" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /x" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /C" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /w" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /L" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /j" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /e" haesik.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\haesik = "C:\\Users\\Admin\\haesik.exe /h" haesik.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe 2724 haesik.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2292 f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe 2724 haesik.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2724 2292 f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe 28 PID 2292 wrote to memory of 2724 2292 f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe 28 PID 2292 wrote to memory of 2724 2292 f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe 28 PID 2292 wrote to memory of 2724 2292 f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f788eb00ea4172250544e956e3742aee_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\haesik.exe"C:\Users\Admin\haesik.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5a756da3d996c064be5be1e6add153575
SHA15d2f0150b21f20c85a0e9a92f48d25b204b0dd51
SHA256a3b3a247819dca9c951cfa1938ab5d477b13cb4277e14e3da5aa923c98275c16
SHA5126c828055250de2daa53d6d7339d7f286d45aa0e25f3fe60216ec82829d9db65822e8a608f53867cef2dc87a8343802a5a7e81c26a3a832828f8a77d6c34db11a