Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe
-
Size
100KB
-
MD5
17e40c57f372e6954fe06389924d8a76
-
SHA1
6432edb1a66a19c6365c733b338a90bac82ef0bd
-
SHA256
8f8ab65e792084c605c3099cfea4bc73fe21f1b4a07b8aa2dddf9162aec2671a
-
SHA512
b101975408ed7b07070addecd6578ebc44bb64e44e35f46d38f6ead3e0e7afea9028d1e43d0b1f8227ba09013967b8cf676e5888c586892137e4c56547bf0254
-
SSDEEP
1536:KMt0L82NTdw42xsLGZcYADZPU1+73BD88b0nyMNIjnZr7:ww4s7gZPUQJMCnt7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" seeved.exe -
Executes dropped EXE 1 IoCs
pid Process 3040 seeved.exe -
Loads dropped DLL 2 IoCs
pid Process 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /N" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /q" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /u" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /R" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /w" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /Z" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /h" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /O" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /r" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /f" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /e" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /H" 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /W" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /L" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /z" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /j" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /T" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /U" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /I" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /J" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /Y" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /d" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /m" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /X" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /Q" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /k" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /g" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /o" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /H" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /x" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /S" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /p" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /B" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /i" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /l" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /y" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /t" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /c" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /s" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /M" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /P" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /b" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /K" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /v" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /F" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /D" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /G" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /a" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /A" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /E" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /V" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /n" seeved.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\seeved = "C:\\Users\\Admin\\seeved.exe /C" seeved.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe 3040 seeved.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe 3040 seeved.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3040 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe 28 PID 2968 wrote to memory of 3040 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe 28 PID 2968 wrote to memory of 3040 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe 28 PID 2968 wrote to memory of 3040 2968 17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17e40c57f372e6954fe06389924d8a76_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\seeved.exe"C:\Users\Admin\seeved.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD56690cb3dfc6c8113cb7e316417893811
SHA1e5ea1080c2b6b288f7faa2982e0da74667876304
SHA25696480a1ada9049112f43a1b9f85dd9558c8561583979903e8dea2c7fcfb25173
SHA5126c3004490702fd45f6299830f464bb7a122832c935aa27f138b68b754d177613f7acb9c230d6769c1b0b92760b5538c5824dec0d3752bf4f8dd06da1c8a0b6e0