Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe
-
Size
132KB
-
MD5
212b843f097d4bd86dec9e7f7b1a04e7
-
SHA1
445af4de5bfb4d14d73df69b54a5fcf3004f6bd0
-
SHA256
dd8d5c6163a7c86db68034ac5ff175c2ff268ed9c9665a1b7e95593b69711448
-
SHA512
5991f039c0d6cbd47ca65c2ec31245320b8f7ee04274b09f1b704d5ab5cd2b414f3e3ab889732e064434bff3602693adc907b1b2f62224151af0e67438232845
-
SSDEEP
3072:E3k/hPrdVfWM8RM/8KmwBErXXFefQmD8ampjE6ei55:T/FX8/KmwBEjXFeos8aCteo
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruaob.exe -
Executes dropped EXE 1 IoCs
pid Process 2296 ruaob.exe -
Loads dropped DLL 2 IoCs
pid Process 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /O" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /e" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /l" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /X" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /m" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /J" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /y" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /c" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /N" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /T" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /p" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /A" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /P" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /C" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /G" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /L" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /f" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /S" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /Y" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /Q" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /F" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /K" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /b" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /q" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /t" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /w" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /z" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /V" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /v" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /H" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /M" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /U" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /R" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /o" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /B" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /P" 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /u" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /g" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /x" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /E" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /r" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /I" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /d" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /Z" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /k" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /h" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /W" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /j" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /a" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /n" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /D" ruaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruaob = "C:\\Users\\Admin\\ruaob.exe /i" ruaob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe 2296 ruaob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe 2296 ruaob.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2296 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2296 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2296 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe 28 PID 1688 wrote to memory of 2296 1688 212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\212b843f097d4bd86dec9e7f7b1a04e7_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\ruaob.exe"C:\Users\Admin\ruaob.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5ba83416159c12b8396767adc6833f9df
SHA1762101f150e050911440c4b2e56e7853a6fb12a1
SHA2563ad17ee938ab4f80e1eb3c5fef0d989e02e1543913bc779c24c9e32eef62118f
SHA512413d56a77f6bc2d528acfbfb408423385bdd32ca8846bf2cc98d5b9ed6824bae7b6c001ded42ca84e34f57cab4a193e037579f276e14621437ca1ce6eb5307a4