Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 19:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe
-
Size
100KB
-
MD5
0f4c907ab82311c294c7513c6bbe2c1a
-
SHA1
1a1d7f83682fa836675af8a7d72882225b2fa13d
-
SHA256
c35dec9ed8b1c738e633ca67e0f3d48440a855923ab750d8dda8ba5491941e33
-
SHA512
53d6c4509da56870c41212842e54c3000880bcbe38590df15dd16dfaa2bfde17c4fd040feb92058bb6104a89e427c528c7f55f3c9612c24c73e4ec28bff38cf1
-
SSDEEP
1536:zvtGn82NTzwDMGAc4ohrPXo+73Rez8b0SyuNIjnZq:0wWurPX7CuCnY
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yoixuq.exe -
Executes dropped EXE 1 IoCs
pid Process 2884 yoixuq.exe -
Loads dropped DLL 2 IoCs
pid Process 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /a" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /I" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /Q" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /k" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /b" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /p" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /R" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /q" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /s" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /u" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /e" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /Y" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /r" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /x" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /N" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /i" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /T" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /c" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /t" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /Z" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /w" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /J" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /A" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /V" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /K" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /H" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /X" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /O" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /U" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /F" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /S" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /l" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /m" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /B" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /P" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /G" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /d" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /W" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /L" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /y" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /N" 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /f" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /M" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /h" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /n" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /v" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /g" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /D" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /z" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /E" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /j" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /o" yoixuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoixuq = "C:\\Users\\Admin\\yoixuq.exe /C" yoixuq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe 2884 yoixuq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe 2884 yoixuq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2884 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe 28 PID 1224 wrote to memory of 2884 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe 28 PID 1224 wrote to memory of 2884 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe 28 PID 1224 wrote to memory of 2884 1224 0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f4c907ab82311c294c7513c6bbe2c1a_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\yoixuq.exe"C:\Users\Admin\yoixuq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5541f9034659ddd1959139bbc29f4b962
SHA1e8d0d4a0d3e46cbddc9363e980e4a5b3066b0500
SHA25697b3369a0204a55de7ca9699d9896beece5b4eaca5994d462cf42df8bee4ad7e
SHA51295418d71d027778363990f428d4c4b4cebe59f194a2ccf6659962f4a73d19fcabad61a014cb8a91b1d19cfbda5de4c2397544ab73fa754cbe16b9effa5f65f68