Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 20:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe
-
Size
172KB
-
MD5
362c3a0db7bad840174ef3deb76f49a7
-
SHA1
d24627dac4a0b231da91d3ec2bb14785afe71714
-
SHA256
941d31ef8e2909b088638b6f39f3a2cae30d6e0301fd31703bfc686aaaf84d7c
-
SHA512
68ab377d7dd60d8b50d832d865ff3926a221b87759408d25d2daf1848423a167b17e2cffad4b6f20379271e1d679d321a42a29413f82bd36e4230c2e2b7afecb
-
SSDEEP
3072:7crmzTIqg4AmWXHSlDMehogxgbDT5qouyX7UgZgkaDqKEmvqsg+j:7UKlAmWXHSlDMehogxgbDTQouyXYgZgB
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kioir.exe -
Executes dropped EXE 1 IoCs
pid Process 2676 kioir.exe -
Loads dropped DLL 2 IoCs
pid Process 2636 362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe 2636 362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /V" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /v" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /l" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /e" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /B" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /f" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /N" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /D" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /M" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /a" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /u" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /r" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /C" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /x" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /d" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /E" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /U" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /i" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /G" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /H" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /A" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /J" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /T" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /p" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /I" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /t" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /Q" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /Z" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /K" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /c" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /O" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /Y" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /s" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /X" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /b" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /L" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /R" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /F" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /h" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /m" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /w" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /o" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /W" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /y" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /j" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /n" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /S" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /g" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /P" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /z" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /k" kioir.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\kioir = "C:\\Users\\Admin\\kioir.exe /q" kioir.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe 2676 kioir.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2636 362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe 2676 kioir.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2676 2636 362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2676 2636 362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2676 2636 362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2676 2636 362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\362c3a0db7bad840174ef3deb76f49a7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\kioir.exe"C:\Users\Admin\kioir.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5b0bca2422369c96b30a27094a6b25958
SHA14407165a078708e52eeef7b975937565c4cab6a8
SHA256bcd38f850dbf50dcdc55f044596ea7d11833a8dc0eb7c63f1a12e5c7259fd7bc
SHA512996de62314bd3bd9e69f7768e18cd9ceb521b7742556b3d7deb1901297f82c89897a2e815c34c65a34bacffe465cbb4e8cc34497f925aaaf97eee94a4a7806e4