Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 16:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe
-
Size
100KB
-
MD5
311523a539a9a0e6a51597e7f78ea80b
-
SHA1
f8c44f0cda28ff6cedc13e83248a36c51ccd336a
-
SHA256
21d84aa593802d4bba5f241b0f0b03093fcca969b997a3ef881d6555c26d7345
-
SHA512
b5a7e126632a0dc4fa42cbb71e3948d2867a1561ffdf873cce2c5c1f13316b94be6e9362563fb18e9e9cc13a9d8d298a32a0db282188b9621c497b61a3e92400
-
SSDEEP
1536:Y9d8iAuismywsTgLw0wF9MGM9K/oKtNgCMbA1bL3N+NM5Uf6NIjP:Ck/KLOM59CP
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vocih.exe -
Executes dropped EXE 1 IoCs
pid Process 2444 vocih.exe -
Loads dropped DLL 2 IoCs
pid Process 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /G" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /K" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /t" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /a" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /R" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /p" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /x" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /N" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /m" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /J" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /q" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /M" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /E" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /b" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /g" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /d" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /P" 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /l" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /L" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /A" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /w" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /s" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /c" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /e" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /h" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /I" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /v" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /z" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /F" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /f" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /W" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /Z" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /O" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /B" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /j" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /u" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /U" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /V" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /k" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /S" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /P" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /H" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /X" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /Y" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /Q" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /T" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /y" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /o" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /D" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /r" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /i" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /C" vocih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\vocih = "C:\\Users\\Admin\\vocih.exe /n" vocih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe 2444 vocih.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe 2444 vocih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2444 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe 29 PID 3008 wrote to memory of 2444 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe 29 PID 3008 wrote to memory of 2444 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe 29 PID 3008 wrote to memory of 2444 3008 311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\311523a539a9a0e6a51597e7f78ea80b_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\vocih.exe"C:\Users\Admin\vocih.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5e3634c98785c6b2b6b3ee714148381a2
SHA1a0607ed9f53aff047483b67970299fdec8728824
SHA256ad5d71bc659c22138325659d62fd3f640e9328aaf0bc83fe29844abeb6f2bac7
SHA512e8453174ec273d57c67fefa69bac52ddcbd1cf3a3cbf70f5089fe507728f8a790a7edcd0c0eaf98645d8335f7014d5ef00893055d99eb4e364078123c2850809