Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe
-
Size
272KB
-
MD5
07b71a3e7009db24c30ddf554b399b8b
-
SHA1
6d37a979dd732b1e8ac0f147b8141ff98c194f89
-
SHA256
0096e2281b590ea7db46ff8a1650c329ae317436f24563ffb53c0104cb418afe
-
SHA512
9fcb28cc05298ed67a6c1bc4de1df736800628d06f0390022353981cba64b18653e4c98cd66ba6e79057ecc5a51ffdb4674c673ad16f5f7b2807756fea89bcf1
-
SSDEEP
6144:P3aElQxchRdjLmtrBuMrdekUH63u+X5sc57W:CxxGLTuPL5
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" leiiv.exe -
Executes dropped EXE 1 IoCs
pid Process 632 leiiv.exe -
Loads dropped DLL 2 IoCs
pid Process 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /v" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /b" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /N" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /X" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /D" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /O" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /r" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /f" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /E" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /w" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /Z" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /q" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /I" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /T" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /Q" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /c" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /P" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /u" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /G" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /y" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /i" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /e" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /s" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /A" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /J" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /H" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /m" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /a" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /h" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /p" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /R" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /g" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /l" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /U" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /M" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /W" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /z" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /d" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /L" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /F" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /n" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /k" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /Y" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /B" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /C" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /j" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /I" 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /x" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /o" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /S" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /V" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /t" leiiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\leiiv = "C:\\Users\\Admin\\leiiv.exe /K" leiiv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe 632 leiiv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe 632 leiiv.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1108 wrote to memory of 632 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe 28 PID 1108 wrote to memory of 632 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe 28 PID 1108 wrote to memory of 632 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe 28 PID 1108 wrote to memory of 632 1108 07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07b71a3e7009db24c30ddf554b399b8b_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\leiiv.exe"C:\Users\Admin\leiiv.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD553b3487d9efd368355b70e30876c70e5
SHA10c4c3e35dba9f695f65bd475ee5873f051e2e1b1
SHA256bdca026a7842758ece057a626ce1f020c5ac30fced4c919b7155cf23a3e901d3
SHA512bcc5fc4eacd2f7efe042b4d6d5461dd4a55ae02c45b96b262d995b47dfb6c1806c1b8658640c2d6397329116731a0b5ad3ee76b98c2bfef217f813c3b8578bc5