Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 05:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe
-
Size
96KB
-
MD5
24c3bd75807cad3b957d8feee18c7d2b
-
SHA1
39a2b175766e52f8e0c0f8553c0bc6f2525e85c4
-
SHA256
cbf3686c355b8f7c230cded1c3af84757da54f5536088f02f6c9103e0cbc79b4
-
SHA512
0da7928d3444b6d8ce2a07edc7de679c555eb3d9459c95b66b48f41cd715955c8a0cd455fc91cd43edeea389aa1cd3f77124c14b69adecf374b6da20182794ed
-
SSDEEP
1536:iJQBHUf6cO/hRrkGulSc16l6u+NMMl/KlYv1Tq5ThFfNIjnZnF:z3hRUlu8CFFfCnVF
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruizoij.exe -
Executes dropped EXE 1 IoCs
pid Process 1708 ruizoij.exe -
Loads dropped DLL 2 IoCs
pid Process 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /H" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /L" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /T" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /A" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /P" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /K" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /g" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /i" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /o" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /j" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /d" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /c" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /R" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /F" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /t" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /O" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /U" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /B" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /b" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /V" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /p" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /M" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /h" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /l" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /m" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /z" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /x" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /Q" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /Z" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /f" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /S" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /s" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /y" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /D" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /E" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /a" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /n" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /I" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /Y" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /k" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /N" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /T" 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /q" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /X" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /J" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /u" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /w" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /G" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /v" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /C" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /W" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /e" ruizoij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruizoij = "C:\\Users\\Admin\\ruizoij.exe /r" ruizoij.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe 1708 ruizoij.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe 1708 ruizoij.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 1708 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe 28 PID 2284 wrote to memory of 1708 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe 28 PID 2284 wrote to memory of 1708 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe 28 PID 2284 wrote to memory of 1708 2284 24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24c3bd75807cad3b957d8feee18c7d2b_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\ruizoij.exe"C:\Users\Admin\ruizoij.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD51caeca50e44fbf590d7b4217d4e49b76
SHA1b5576460a3d88d4fd77f855d3043db8680704205
SHA256d9a3e322c40d1725c66e70b6dd27efbd3afbc1c0285dd625c4f93aee49ece801
SHA5120c0b74f17290fb36d50cb34574cabbbc46709bc1e09212dbeb927b30e50779c5f095198206cdd04d5941a235c0dead52500001387830d57b2c725a73c9a7ee21