6a00898d7c7aff4604ae5aee80ff9efd2c7dff2da17ad9dda2d24092fa3c5fac

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe
Size

272KB
MD5

330f648a9459329c3f72f2ba3e3feedb
SHA1

ae90712aaa986273ff5a68ff124fb8329fdc447c
SHA256

6a00898d7c7aff4604ae5aee80ff9efd2c7dff2da17ad9dda2d24092fa3c5fac
SHA512

417448d23456046c3b78990a804e76cd93d73a2e78a04cb488dde6ad9706cd9d21d22cce03f1a2314cb8f512de475bf5e5b925b42e21b2f319249875c443c4a5
SSDEEP

6144:wjFM2ymU8iHOADP0UfV3SHWPIxXZgO+VeR8RUq:VkUfJSj+R

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ydmif.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	ydmif.exe

Loads dropped DLL 2 IoCs

pid	Process
1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe
1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /o"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /c"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /S"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /L"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /p"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /Q"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /N"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /v"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /W"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /B"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /C"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /f"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /s"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /g"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /t"	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /X"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /H"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /i"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /q"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /J"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /E"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /z"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /y"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /A"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /n"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /D"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /k"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /Y"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /T"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /j"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /u"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /O"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /P"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /h"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /K"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /I"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /G"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /b"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /t"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /V"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /F"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /M"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /r"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /d"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /R"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /w"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /m"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /x"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /e"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /l"	ydmif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\ydmif = "C:\\Users\\Admin\\ydmif.exe /Z"	ydmif.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe
2412	ydmif.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe
2412	ydmif.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2412	1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2412	1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2412	1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2412	1908	330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\330f648a9459329c3f72f2ba3e3feedb_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\ydmif.exe
  "C:\Users\Admin\ydmif.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\ydmif.exe

Filesize
272KB

MD5
d6b3c87117c4770cf8c01af35d3fd8d9

SHA1
55b8834ecfc7a3301bc25ee543009147c03a4bfd

SHA256
f58c1fdbb6f6725998f4901a699ed6ddc21c9da09a2e84d318624375e0f96e63

SHA512
4943c4086c6c281cfc0ce080b610398779876031b2322bd09e95e0a9939af90de4fc54c365c94ba34da14940e3ece272a515949cae1fa893dddb13ec50581350

Download Submit