Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-07-2024 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe
-
Size
248KB
-
MD5
398d4ae185f22e5d07c0ce0bf73c9fdc
-
SHA1
2a258dded4ce0a69554a90e64c6b49e530c87d20
-
SHA256
1c28f7f18e7a1289391f84a7cbad3adf4a482aa469f49fcb54afada036ebae68
-
SHA512
885a7643f9a2209df15307d71f7c9e4d03e97ad4756c353637fd86b6e5b20abd53e3e5933625640b4bfb4ce9a28349f0902253a84daedb0fc1a88fe1d5930f4d
-
SSDEEP
6144:knLRZByIFaE+yisPBwP5hvAlGJoeHiPrAqlxx2JHWPvZEzc6QH2fKM+i:k9ZB7FaE+yBBwP5hIZOHW3kQ6KM
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yoeugi.exe -
Executes dropped EXE 1 IoCs
pid Process 1572 yoeugi.exe -
Loads dropped DLL 2 IoCs
pid Process 580 398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe 580 398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /D" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /E" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /q" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /R" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /i" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /I" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /X" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /L" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /h" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /l" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /n" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /A" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /v" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /s" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /F" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /w" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /d" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /K" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /u" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /z" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /b" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /Q" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /e" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /r" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /V" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /j" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /O" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /J" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /H" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /k" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /y" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /f" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /U" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /C" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /c" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /S" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /Y" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /m" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /P" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /W" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /x" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /o" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /N" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /G" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /T" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /t" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /p" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /B" yoeugi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoeugi = "C:\\Users\\Admin\\yoeugi.exe /M" yoeugi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe 1572 yoeugi.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 580 398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe 1572 yoeugi.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 580 wrote to memory of 1572 580 398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe 29 PID 580 wrote to memory of 1572 580 398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe 29 PID 580 wrote to memory of 1572 580 398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe 29 PID 580 wrote to memory of 1572 580 398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\398d4ae185f22e5d07c0ce0bf73c9fdc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\yoeugi.exe"C:\Users\Admin\yoeugi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5c6f3802129f09b3b3c341124b7ef526e
SHA15b644a3ddd9b8308c732f7073ee43f0a4bbe6e78
SHA256c4aefcee33595f6a894d9d6f4fe697adf6c52c64d61c53b4b040e7e83c0f2f6e
SHA512d149fc8bba289345443ee8045ef164279673c943b8253e02cd353138becd7bf7b0ffc58ee6afe0f5663b1ba5f6b2ff82931d1cf739d467cd4272113d4c1761cd