Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 09:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe
-
Size
232KB
-
MD5
342bc8cd8a2c8588ad9711f2c4d49996
-
SHA1
a77bb525602b7b03eb23934c7494338391c40749
-
SHA256
ddb511dc6b92d05862f7655567a5f02bcb1d48b60a4727bca38aea072ba0a3c7
-
SHA512
cdd897080a481fc21f7815b44726f02a348b92631cc25727c55c33c3968412405c1a8a8d8c5d51434582b7ccfb8a4707783bb499962608f7ea4acff461a593d3
-
SSDEEP
3072:l74jJRhibdBG5XoC8ctR8imbQhpwI9J5zTbK2VzvPpi52mwzlM9I9IVtQ/ij:lcwnhctRnmMhpL9J53vTRi52mwzB+Q/2
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cxwuon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2144 cxwuon.exe -
Loads dropped DLL 2 IoCs
pid Process 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /C" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /x" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /L" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /Q" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /K" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /l" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /a" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /B" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /S" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /s" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /t" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /i" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /F" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /n" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /V" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /z" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /Z" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /N" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /R" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /u" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /k" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /v" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /E" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /O" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /j" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /T" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /g" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /d" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /c" 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /m" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /P" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /I" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /W" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /Y" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /X" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /D" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /r" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /J" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /y" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /M" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /H" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /o" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /G" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /h" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /f" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /b" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /w" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /q" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /e" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /U" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /c" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /A" cxwuon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxwuon = "C:\\Users\\Admin\\cxwuon.exe /p" cxwuon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe 2144 cxwuon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe 2144 cxwuon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2144 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe 30 PID 2080 wrote to memory of 2144 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe 30 PID 2080 wrote to memory of 2144 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe 30 PID 2080 wrote to memory of 2144 2080 342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\342bc8cd8a2c8588ad9711f2c4d49996_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\cxwuon.exe"C:\Users\Admin\cxwuon.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD51a42708a5ab9af8aa970d20f4ebf6785
SHA1110dad8ddf2e8e1f53e601379842b0cc41c47865
SHA2560e13f940af5428a88fd65cdce399bd29399ddbcc2c63f716fb28f46304489613
SHA512a1c53bcf33a649a2720e5830058a4560200ca2222adce310350d75488edd6723bc1f7341661d6271a60892d1da1d3e584ed0b0cb82b85b6325c3225adee917f4