Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
19/06/2024, 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe
-
Size
92KB
-
MD5
013ea59f1b96074224df212f98f5ac8a
-
SHA1
f16fad443f25b172767afe15ce4d26ea65f8b71d
-
SHA256
8a7d38d69005cb24a287f5fb53edbcad34014dbce4711088bbe193348c6a88d6
-
SHA512
e62996186baf95bf3de8f2c144acb9cb7907146825e95fd7a72ac23a37cadff2c5a2468252aee13768585cab70b77b41a9500fe9ae09e1542d9571cf67e86b92
-
SSDEEP
768:7nOhIjoJgrZdr+KGz5BAtpm4eutfrWTVtTZ/BliKG1jiTa9McTfkQ3ca:7JDdS6pm4aTZ5XG1jiTa9McrkQs
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" guoay.exe -
Executes dropped EXE 1 IoCs
pid Process 1168 guoay.exe -
Loads dropped DLL 2 IoCs
pid Process 1444 013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe 1444 013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /c" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /x" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /W" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /G" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /C" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /U" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /g" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /i" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /P" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /H" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /V" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /L" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /z" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /Y" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /d" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /F" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /s" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /E" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /n" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /l" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /B" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /h" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /Z" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /O" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /r" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /b" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /A" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /R" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /f" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /I" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /M" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /N" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /D" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /T" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /S" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /e" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /o" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /X" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /u" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /w" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /J" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /k" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /y" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /q" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /t" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /j" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /K" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /m" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /v" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /Q" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /p" guoay.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\guoay = "C:\\Users\\Admin\\guoay.exe /a" guoay.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe 1168 guoay.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1444 013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe 1168 guoay.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1168 1444 013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe 28 PID 1444 wrote to memory of 1168 1444 013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe 28 PID 1444 wrote to memory of 1168 1444 013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe 28 PID 1444 wrote to memory of 1168 1444 013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe 28 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27 PID 1168 wrote to memory of 1444 1168 guoay.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\013ea59f1b96074224df212f98f5ac8a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\guoay.exe"C:\Users\Admin\guoay.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5bb1dd430d27d3372b49ad08c879f198f
SHA1ea074006028a3094f1fb6c54a870d285f1055a3b
SHA256c0e99ce329b8e10c8ffcb797b024cf8bf98fc6e7d9f80012b7f4947efe70d387
SHA5124ed45b524eacb0722bbcdfe7ade5bea326b8bafb6b68ce3b44b754769d46d7069ebd1b94928243a439cc2ea646dd087c51405e155ef8f5230e4b09340c345467