Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:10
Static task
static1
Behavioral task
behavioral1
Sample
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe
-
Size
200KB
-
MD5
36655a0b11773cacf42ec2ca9ca3ec50
-
SHA1
64c4be9d982d56106f7d8167c07295da4d9d8e0d
-
SHA256
9df5a67c5941d24ac50ad1dd41f73a4438850f30b111d45c154a69b5d0573907
-
SHA512
e5e6c7be87fbf10e2106af4635cc6a3a4bf67ef83e01d7802c29c97793759b452d3e30381124ae80754035b19acd7e380f743eb4f2ad8bef3a671ca80159580b
-
SSDEEP
3072:wR7To/05Wr0tQ9nLHbB9WBJiBs2HWWEaPGJm9wFH:wRix4QxL7B9WBJi+yWWEaUjJ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exeroaboa.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" roaboa.exe -
Executes dropped EXE 1 IoCs
Processes:
roaboa.exepid process 2804 roaboa.exe -
Loads dropped DLL 2 IoCs
Processes:
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exepid process 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
Processes:
roaboa.exe36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /m" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /f" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /b" 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /n" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /e" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /k" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /i" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /j" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /x" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /s" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /q" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /a" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /w" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /t" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /c" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /b" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /h" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /g" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /r" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /o" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /z" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /p" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /l" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /u" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /v" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /d" roaboa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaboa = "C:\\Users\\Admin\\roaboa.exe /y" roaboa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exeroaboa.exepid process 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe 2804 roaboa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exeroaboa.exepid process 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe 2804 roaboa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exedescription pid process target process PID 2632 wrote to memory of 2804 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe roaboa.exe PID 2632 wrote to memory of 2804 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe roaboa.exe PID 2632 wrote to memory of 2804 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe roaboa.exe PID 2632 wrote to memory of 2804 2632 36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe roaboa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\36655a0b11773cacf42ec2ca9ca3ec50_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\roaboa.exe"C:\Users\Admin\roaboa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5051c236a64a42569e2a6b91a9ec0e50b
SHA1e9524cea690c7fda91bd9d257ad5498840575219
SHA256170e70c1176625624c5afc311beadc55556978e22eb9913f7c9359637fc57517
SHA51275a35ee0ad9a40e20522022764ee4619826cb7da6f882be784742fd3c9b0c6a0d07e233b8f4439bfc8aa0cee64d0c801a8051f0749b5b720775f18838512f2d5