Analysis
-
max time kernel
149s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe
-
Size
228KB
-
MD5
399a3be128438170cc7d1d5a5eca3db6
-
SHA1
4740ddb60cd9e06298fbab55845130a5ae3f6daa
-
SHA256
5a115fe312e225a7318d293ae315abd5978e205950c49288d474184815e753bc
-
SHA512
51274a63e247ab633d816b20cd51f95611af830b1d6c89b466b5c24a331c588e41361d1d4b3024baf8efc582dcafa44fd7f8341c5ffd6736a9d667d12bbb6405
-
SSDEEP
6144:jmI3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/dF:jmyPhAmZIH+n
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neufuv.exe -
Executes dropped EXE 1 IoCs
pid Process 2464 neufuv.exe -
Loads dropped DLL 2 IoCs
pid Process 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /m" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /b" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /w" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /d" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /h" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /g" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /y" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /j" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /l" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /i" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /f" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /p" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /n" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /v" 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /x" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /a" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /s" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /k" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /e" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /v" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /t" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /c" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /o" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /u" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /q" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /r" neufuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\neufuv = "C:\\Users\\Admin\\neufuv.exe /z" neufuv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe 2464 neufuv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe 2464 neufuv.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2464 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe 29 PID 3008 wrote to memory of 2464 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe 29 PID 3008 wrote to memory of 2464 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe 29 PID 3008 wrote to memory of 2464 3008 399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\399a3be128438170cc7d1d5a5eca3db6_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\neufuv.exe"C:\Users\Admin\neufuv.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5c88d58285e090bb1c07add2a1d693b0f
SHA139f1ee603b08e5678590c5cc8fbb85fb9978f610
SHA256661d117710630e2dd3bd142bc658f6bc2828722c205f93bfd90da278a259fbf3
SHA512805d4e86374f82b7a3c63d6aee04e48a074c953abc9b1193ae71b45d1c8bb3b2006c23099b10e95c427b724189a58f0c6863c3db5c4baa0864a7cdba26e88bd0