Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe
-
Size
248KB
-
MD5
36641b0a718d811e74fde8ef7dd0ed32
-
SHA1
8426c305ac2e732f643d4e1357b57353f7e25e30
-
SHA256
fe87a12f6e6195ea889f8f8f1f0f48c9cb8c75bf9bc678e1130dd8451b13cc32
-
SHA512
e7048deb5c4a3fe0e2d0f0890ac369f64d62c46166bdd8a9203bb7030b3b721b172f61f149279b045d97ba46b0ef35baf2a09e062f730a6bc522532d81d3b0d6
-
SSDEEP
6144:dvM5CElofkFWQPtnRneqAKnvmb7/D269fgwMty0e6ndv0DO:dE5CLkFfnRnWKnvmb7/D26qndv0DO
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exempran.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mpran.exe -
Executes dropped EXE 1 IoCs
Processes:
mpran.exepid process 1968 mpran.exe -
Loads dropped DLL 2 IoCs
Processes:
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exepid process 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
Processes:
mpran.exe36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /K" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /D" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /z" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /r" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /a" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /e" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /w" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /u" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /P" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /Z" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /y" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /Q" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /h" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /R" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /A" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /k" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /N" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /E" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /I" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /V" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /j" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /F" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /X" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /S" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /l" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /q" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /O" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /G" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /W" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /v" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /J" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /n" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /p" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /M" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /x" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /H" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /L" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /t" 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /f" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /Y" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /d" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /U" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /B" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /s" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /i" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /m" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /t" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /g" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /o" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /T" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /b" mpran.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpran = "C:\\Users\\Admin\\mpran.exe /C" mpran.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exempran.exepid process 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe 1968 mpran.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exempran.exepid process 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe 1968 mpran.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exedescription pid process target process PID 2320 wrote to memory of 1968 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe mpran.exe PID 2320 wrote to memory of 1968 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe mpran.exe PID 2320 wrote to memory of 1968 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe mpran.exe PID 2320 wrote to memory of 1968 2320 36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe mpran.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\36641b0a718d811e74fde8ef7dd0ed32_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\mpran.exe"C:\Users\Admin\mpran.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5430a7e66ead8c8f72218700b54f3a41b
SHA14eaf00cb7f87c1ce9df8cd90cd03b72c69cd86a3
SHA25647c4b36af02cb7d1db4ad6012598a91b24a4d9887171589785ff48ba7fc7565d
SHA512b8eb58b3af0e900a52c46d9f342537adeacfcf421b0b2af24762e3ca4b0a4a313cbae7fc730b7e03dd0152e62fda4424cacc4553ab5e2a7023b009afc102e62e