Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 09:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe
-
Size
240KB
-
MD5
2fd410ce04d59836e14a590403ff247e
-
SHA1
42a1c6451c3281258c92af8589da93fea3872537
-
SHA256
b2cf7985dac85481928af6f9a081efa7f9dd576d03ee1004189e0843194abf64
-
SHA512
a0169dfebdc878c4720acd4c313bda562817997aff7cc30e433d4627a51cebd4161e49e9ac9bb697d03e4efce50dabc431402f4f23971758b99ec1559f96d993
-
SSDEEP
6144:ko55UtO7RQjX7XN1kd9JbSDviiopNDa/N08i1/W:Y4xNTW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hltuiw.exe -
Executes dropped EXE 1 IoCs
pid Process 1304 hltuiw.exe -
Loads dropped DLL 2 IoCs
pid Process 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /M" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /V" 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /d" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /w" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /j" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /S" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /I" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /q" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /C" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /y" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /N" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /T" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /g" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /G" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /J" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /Y" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /k" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /F" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /x" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /Q" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /U" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /z" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /p" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /W" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /R" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /h" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /B" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /e" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /X" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /c" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /f" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /Z" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /A" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /b" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /o" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /t" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /i" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /E" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /n" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /l" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /D" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /P" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /V" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /v" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /m" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /r" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /K" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /s" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /u" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /L" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /a" hltuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\hltuiw = "C:\\Users\\Admin\\hltuiw.exe /O" hltuiw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe 1304 hltuiw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe 1304 hltuiw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1304 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe 29 PID 2552 wrote to memory of 1304 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe 29 PID 2552 wrote to memory of 1304 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe 29 PID 2552 wrote to memory of 1304 2552 2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2fd410ce04d59836e14a590403ff247e_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\hltuiw.exe"C:\Users\Admin\hltuiw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD58041d29d13b16916282a5f3b1e401c4e
SHA1b1a30960c2e0af03e6471fbcaf2e39e48c7317d6
SHA256fbc22f9c6a6b1c94cf0672c570127f03850e9d41feb8ad52e1a1ad08040ca73d
SHA512d482c72f75de68161e2bac9e03607e52b1296869c99db3a0b6bffc49d9a526929e48ea795a2d80056f0a525ac0f8d5724a6b3f76b68c21712c9525013246e87d