Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe
-
Size
196KB
-
MD5
264ac9cb3484e95fef736bc8f6c16ae0
-
SHA1
898412240eeab60c57f4650ca8e330f42ca9d6b4
-
SHA256
fde653fd76ec66851fa802b44269041643ba6a6d95e905da932cd3fa72010128
-
SHA512
7225accea5d4c6f2e5a5e0b65186980f37c541237ee05e871b057a7020011e5cf2dcad305fdded448ca1c307fc9de848b3ed1d5e8732017dd213a01086bfc043
-
SSDEEP
3072:5Jsue4cQPGDQicxBrGB+GJuyGI/YL1oxR8HXQ:5JsxrQP4aGjQyM1y+g
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zjxeil.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2140 zjxeil.exe -
Loads dropped DLL 2 IoCs
pid Process 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /r" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /d" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /g" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /Z" 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /O" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /A" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /Z" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /K" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /V" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /F" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /i" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /s" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /S" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /o" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /E" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /z" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /e" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /U" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /G" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /j" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /R" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /l" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /Y" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /T" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /W" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /B" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /t" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /p" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /M" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /f" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /I" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /b" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /a" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /v" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /h" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /m" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /C" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /c" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /D" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /N" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /y" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /u" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /J" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /L" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /n" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /q" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /H" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /k" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /Q" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /x" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /X" zjxeil.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zjxeil = "C:\\Users\\Admin\\zjxeil.exe /w" zjxeil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe 2140 zjxeil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe 2140 zjxeil.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2140 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe 28 PID 1968 wrote to memory of 2140 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe 28 PID 1968 wrote to memory of 2140 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe 28 PID 1968 wrote to memory of 2140 1968 264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\264ac9cb3484e95fef736bc8f6c16ae0_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\zjxeil.exe"C:\Users\Admin\zjxeil.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD544cfea7373f11c9800c056889cbd81c6
SHA104670d2fa187d390b7ea679144b5ace0ff0edd87
SHA25663464913164b44461834eb5b993ad68d757cb623f4f13032f2a9c46f0e6b0659
SHA512f7555cf0ed9e50e91e16340be3111221621bc4a167edfe8600bd01d8ad0c7e79b229c2f9d0faac2e7e1e9d9c900be310451afcfe40a86b63886d4f99ed6bab23