Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe
-
Size
172KB
-
MD5
35956406a80138ba654bd9b90b8c5a0b
-
SHA1
28d7f62d03ea39c848f34dae2501a8affb03f6e2
-
SHA256
1d3bb402d515a8fec020672f3d4024a55f7e01b94d0304121cef1abb81280527
-
SHA512
379b689ce24571602a5e2df88159295040d27f69ccc63d3ec13994cbc63aad1d0fbf09c9690dbfee9c4be29ea49edcd36cce5a993b4ade996f98222d39f345ac
-
SSDEEP
3072:7z3QXXeRgw3tiKnvmb7/D26nYNpnHzqTT8RUFwjkKvLg3dvCgIHzmWZAlGbB8iBn:vAXXeR1UKnvmb7/D26nSnTqTT8RUFwjH
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" paoheux.exe -
Executes dropped EXE 1 IoCs
pid Process 1312 paoheux.exe -
Loads dropped DLL 2 IoCs
pid Process 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /I" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /o" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /H" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /W" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /n" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /F" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /c" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /v" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /M" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /y" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /U" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /f" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /b" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /t" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /G" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /J" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /T" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /R" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /E" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /K" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /C" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /V" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /j" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /w" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /B" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /S" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /g" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /s" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /e" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /x" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /Z" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /r" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /q" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /X" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /d" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /l" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /s" 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /k" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /h" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /P" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /A" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /Y" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /D" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /L" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /m" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /Q" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /i" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /u" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /p" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /a" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /N" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /O" paoheux.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoheux = "C:\\Users\\Admin\\paoheux.exe /z" paoheux.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe 1312 paoheux.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe 1312 paoheux.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1312 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe 30 PID 2476 wrote to memory of 1312 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe 30 PID 2476 wrote to memory of 1312 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe 30 PID 2476 wrote to memory of 1312 2476 35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\35956406a80138ba654bd9b90b8c5a0b_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\paoheux.exe"C:\Users\Admin\paoheux.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5593c5c0870718637e3d71366c5023492
SHA18201d5839661254398cc145fefb53ac43bd35edf
SHA256625e70100f0868ebb7b8aa1faa9e132c85523659b690ca4076d6419d58fdc866
SHA5126762bec4f596661b2fcd87edf718ec2a045f08a6e96e11f0c178c733dd40bbb2fcc7ed8f268c2a0f804b79df0bf6680dca880325fc52143040415003bd7f9ab2