Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 15:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe
-
Size
60KB
-
MD5
09410cd64e4c3ddc45a0f7a9e705093c
-
SHA1
e6446fd06fa7efbb34f345677f6d6a571eb9fe86
-
SHA256
e2c6c075e5337f1c29781972cbd7a849486fcf2a9aab258a5848104739e334bb
-
SHA512
9de6a85292a9ee121c493057395328f3d446dc8d47154a649b8b32a3717f734a456087cb9702f13d7a343e01327d66af924bf5798e0f547901a71cd6175e4373
-
SSDEEP
768:+XWmpnBOFlpJ1VUU6+9A/v/bVlbdfs3OfKDHGIHY56WX:+XWNpJXd6y43wY56WX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quoox.exe -
Executes dropped EXE 1 IoCs
pid Process 2064 quoox.exe -
Loads dropped DLL 2 IoCs
pid Process 2992 09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe 2992 09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\quoox = "C:\\Users\\Admin\\quoox.exe" quoox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe 2064 quoox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2992 09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe 2064 quoox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2064 2992 09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe 28 PID 2992 wrote to memory of 2064 2992 09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe 28 PID 2992 wrote to memory of 2064 2992 09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe 28 PID 2992 wrote to memory of 2064 2992 09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe 28 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27 PID 2064 wrote to memory of 2992 2064 quoox.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\09410cd64e4c3ddc45a0f7a9e705093c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\quoox.exe"C:\Users\Admin\quoox.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD57877e8374d45935f8073ecc1b835ca2a
SHA1d5110253f08d9238550eba01c685aa9f3e385538
SHA256e9cfeb7de224992c303e36aecf1acae991da5b4cb285b83a06e87654d240c9ae
SHA5128e7f9020253d8ae174d7fc1a4051cff48c992e07bff9619b871d345a73a4ccaca944d2c8ef5cb36e5df449cabe8dad845383466a03780a4df0978cb6d24f02d4