Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe
-
Size
92KB
-
MD5
38b7ac8d595e2af2e26a3d13aa4dc6dc
-
SHA1
855779e22bcefef74cd73e0ea9d5fb36b6fad34d
-
SHA256
40f8fd4a504eb1201cdfb764b7583836c39fa8b6c312e6cf6821e550623e271c
-
SHA512
99b642ed9b1bc7b6c38ee48dca62007ee3495dffdebba2c0a75bd9650a422713b863fc944559cdcfb07c16bb71aa52c30ad938f5a11446b43e2e47c4c6255b27
-
SSDEEP
1536:KcvNmNqJbtdiivGVR6njalbA/yTgFmLrgc1cWcZc+c5cusZy7xp0gZPk5:pOqJtdJy8iAyzZPO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" boecau.exe -
Executes dropped EXE 1 IoCs
pid Process 2140 boecau.exe -
Loads dropped DLL 2 IoCs
pid Process 2348 38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe 2348 38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /D" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /v" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /E" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /N" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /i" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /S" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /e" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /Y" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /F" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /m" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /M" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /d" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /H" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /G" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /Z" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /K" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /o" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /t" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /z" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /k" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /y" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /T" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /a" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /j" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /f" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /p" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /s" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /P" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /b" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /L" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /x" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /q" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /u" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /U" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /A" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /Q" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /W" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /I" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /l" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /g" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /O" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /X" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /n" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /R" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /C" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /B" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /J" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /V" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /h" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /w" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /r" boecau.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\boecau = "C:\\Users\\Admin\\boecau.exe /c" boecau.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe 2140 boecau.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2348 38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe 2140 boecau.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2140 2348 38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe 30 PID 2348 wrote to memory of 2140 2348 38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe 30 PID 2348 wrote to memory of 2140 2348 38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe 30 PID 2348 wrote to memory of 2140 2348 38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38b7ac8d595e2af2e26a3d13aa4dc6dc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\boecau.exe"C:\Users\Admin\boecau.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5c0def01c23897d23e71f8f2e133aae8b
SHA1938bb8e9527d2f71eb0423121bb25a3c8ec082ff
SHA256db1a0e1e4f6028699fb818ade1ebbb0901256cc0ed47e60a7df8eba48599b5b8
SHA512889c30d55bf7a81a8572618614e6ef791299c9c3cf5ab414759e9ca480767edc7d1f242003303f34085a753cbd76af663c1e4ec18e475377ee18dbd96a0a431b