Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 19:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
236dfce867a49a881be821ed134e294c_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
236dfce867a49a881be821ed134e294c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
236dfce867a49a881be821ed134e294c_JaffaCakes118.exe
-
Size
228KB
-
MD5
236dfce867a49a881be821ed134e294c
-
SHA1
c01f1adf2244a36ba916ba35c26ff9c650b04fac
-
SHA256
639282522c568d848f1c0d3b689986d694c8cb7dfc602d9ac93c89cc0d66f3e2
-
SHA512
92132dba16cd9fd84d6aed9d31d66b1f9d863577ea588f32234a287a48a06f148fb008d129c14596c3ddd43fa8febb4a5ef3127aae95de73691604f31a7673f2
-
SSDEEP
3072:vhOw6tYi5HPOrhLYhRiHi+nklyWxYZXJWTUuEWG91A2/shrS9iRle6G+pAxIbYpN:JOr2rhLw7+ko4iXATUuE21S9isgS
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jaked.exe -
Executes dropped EXE 1 IoCs
pid Process 1936 jaked.exe -
Loads dropped DLL 2 IoCs
pid Process 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /f" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /g" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /q" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /r" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /O" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /z" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /F" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /V" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /Z" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /J" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /N" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /P" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /U" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /E" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /M" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /s" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /W" 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /y" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /i" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /j" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /u" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /T" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /L" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /A" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /w" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /d" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /D" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /I" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /H" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /x" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /X" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /S" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /l" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /v" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /h" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /b" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /m" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /Y" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /c" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /a" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /K" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /e" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /G" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /Q" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /n" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /R" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /k" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /C" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /o" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /B" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /t" jaked.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\jaked = "C:\\Users\\Admin\\jaked.exe /W" jaked.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe 1936 jaked.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe 1936 jaked.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1936 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe 28 PID 2180 wrote to memory of 1936 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe 28 PID 2180 wrote to memory of 1936 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe 28 PID 2180 wrote to memory of 1936 2180 236dfce867a49a881be821ed134e294c_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\236dfce867a49a881be821ed134e294c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\236dfce867a49a881be821ed134e294c_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\jaked.exe"C:\Users\Admin\jaked.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD578b29838bafd9b6af94f68c9d132c295
SHA1fda19cb577ffb7ef05d5e7b1fab906c31ccd5390
SHA256663b5dc87596ab7740c679a3e61bd11af0fb100aa39e9a6603ba4dfd9440e70c
SHA5128d447bef70a4a05d2cf954570e491c1910cd494a546f75edd8fd782c7adb3a695261d1bba05580f25a2c162d136edb3f9bc8f2fff47d86d78ab1278cc901b56d