Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe
-
Size
312KB
-
MD5
18debbd56f06d86a1eaeeb67c6e7a987
-
SHA1
5ffb4f1383176706da2d9cecbd2368d11441bacd
-
SHA256
ee2b7aec69d49f4e0f5b21e95e3f7f5a0a7cbd47b891d996fecd21e2c403b389
-
SHA512
d00f7e982954f4ab56f4e7ff4aa3919742fc66294d728d836dbec615c7409efb0bbeede1ca9ce831def9e16a9c8ea278cca7cefbb7a5bd4f253af4cb57219bca
-
SSDEEP
3072:E1TsZWqobBOxJYwExxusUwadNX0sQ84O1fNnoPBEtFjjUcsFP84K6yXX7:2TlBOxJYw4xusUwsJ0sQmWWuPxnyXX7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fiioy.exe -
Executes dropped EXE 1 IoCs
pid Process 2032 fiioy.exe -
Loads dropped DLL 2 IoCs
pid Process 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /a" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /f" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /k" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /p" 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /w" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /b" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /o" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /s" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /j" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /v" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /q" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /y" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /h" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /p" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /x" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /r" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /z" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /t" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /e" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /d" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /u" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /l" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /g" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /c" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /i" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /n" fiioy.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiioy = "C:\\Users\\Admin\\fiioy.exe /m" fiioy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe 2032 fiioy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe 2032 fiioy.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2032 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe 28 PID 2208 wrote to memory of 2032 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe 28 PID 2208 wrote to memory of 2032 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe 28 PID 2208 wrote to memory of 2032 2208 18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18debbd56f06d86a1eaeeb67c6e7a987_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\fiioy.exe"C:\Users\Admin\fiioy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD54e72a83a0f4233f0fb0e0a148cc6cdb8
SHA168b9f51754c6952d59462328adbfbecba4912eea
SHA256ca3b5cc5d51bddb4d735197d59b72dd146b093e24792275f934010e62135a439
SHA51237fb0b6be840d986ef3eea58a8aaf318a3b8d66cbb535a87fb396a2ebb99d200bd5e86d39a715d7b2ab9b569f1216638afe8d585a43aff164eeafe4d0b6426c6