Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe
-
Size
272KB
-
MD5
2834a5e6f9247c00b3362af7b9a762e0
-
SHA1
274e29d38dde9902f52b7d3de19677c5a156c234
-
SHA256
8c733c055b4b26b6f3a45b0efb37bd6c503e9cb08ec2b93716c7c72e915fd990
-
SHA512
460d755032763bbcb5567ee1279661569c5c194092ebec957c770a7f147d126939660937b1827be55375b9767831aa0129545fef142b4c49bae924e957620a77
-
SSDEEP
6144:MjF9rymU8iHOADP0UfV3SHWPIxXZgO+VeR8RUl:AXUfJSj+R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hosek.exe -
Executes dropped EXE 1 IoCs
pid Process 2096 hosek.exe -
Loads dropped DLL 2 IoCs
pid Process 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /N" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /I" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /Q" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /E" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /N" 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /B" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /P" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /f" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /D" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /i" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /a" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /M" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /C" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /v" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /e" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /s" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /k" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /j" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /R" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /p" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /y" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /G" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /Z" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /L" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /O" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /c" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /X" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /n" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /t" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /u" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /K" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /g" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /w" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /A" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /W" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /h" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /H" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /b" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /z" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /o" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /d" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /l" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /J" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /m" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /T" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /x" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /V" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /S" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /Y" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /r" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /q" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /F" hosek.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hosek = "C:\\Users\\Admin\\hosek.exe /U" hosek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe 2096 hosek.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe 2096 hosek.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 912 wrote to memory of 2096 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe 28 PID 912 wrote to memory of 2096 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe 28 PID 912 wrote to memory of 2096 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe 28 PID 912 wrote to memory of 2096 912 2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2834a5e6f9247c00b3362af7b9a762e0_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\hosek.exe"C:\Users\Admin\hosek.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD576c5a163e161fd0a499577b51cddbd07
SHA1676b2ef210b3b74781a2f6f775781b96f77543ee
SHA256a6e14a79272de1654ddf5e0516e8aaf2821460842c6bc5cfba2e27aacc3fd922
SHA512718b4101d96e169b97550d04f2050aac1d0b51900405bb8c44a73d2666dc91b2b55dea226a220aafe1a70a9ebcdd93237ed7f56caab832dbf95f49aab29266d6