Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 08:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe
-
Size
124KB
-
MD5
27df097f02c69f6849b49b496e54ece8
-
SHA1
dc16b4852a6dbc2282efd038aaf7539e8653e292
-
SHA256
a2a0aa176b11add242e76bd32aa621da68821649d51f0e8726e792f3e5c9898f
-
SHA512
4df20f5b81dfc51f2d8ca8ff1e40d78be70e3c9bf9599608746b0f79ea9d3de54fd098658b5a79435f1dee997e15750922cf2601a6abdfc2d4226c36781ffbc6
-
SSDEEP
1536:SwEng4wRZuBxLDtVdHa27J14lWxporZ45i8NeG0h/l:rEg4wRZkLt6gJ1uPt45yt
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wtkuex.exe -
Executes dropped EXE 1 IoCs
pid Process 2808 wtkuex.exe -
Loads dropped DLL 2 IoCs
pid Process 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /q" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /u" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /R" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /W" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /g" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /o" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /E" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /J" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /b" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /Z" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /L" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /e" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /c" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /K" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /T" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /h" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /d" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /V" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /n" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /B" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /D" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /G" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /y" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /A" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /X" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /w" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /M" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /t" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /s" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /p" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /l" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /j" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /z" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /o" 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /x" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /f" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /P" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /I" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /a" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /k" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /S" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /m" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /Y" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /i" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /N" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /H" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /Q" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /F" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /v" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /r" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /C" wtkuex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wtkuex = "C:\\Users\\Admin\\wtkuex.exe /O" wtkuex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe 2808 wtkuex.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe 2808 wtkuex.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2808 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe 30 PID 2868 wrote to memory of 2808 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe 30 PID 2868 wrote to memory of 2808 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe 30 PID 2868 wrote to memory of 2808 2868 27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27df097f02c69f6849b49b496e54ece8_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\wtkuex.exe"C:\Users\Admin\wtkuex.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5830f4d914fa2b8d5000890c51a98c944
SHA1d93d06f7f734d6d82c47bc39b8cc4c4103e33417
SHA25606e73f57dfb908ec40443b90f7cc0727e190fe8f7afdf112af01942fb1f88ef3
SHA5123c4ffc4742342e5ed18801b8618ab7c2edad3143ebbb5460347cb7f9a86bee2a7d03cf91f2231111a55fc22733734ed0c2cff76c4894a492a474a864eff1d705