Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 02:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe
-
Size
232KB
-
MD5
3ba796b6291f1af40fa7f7910cfe20e0
-
SHA1
83138d469539d6f00f0a557f305e667a5a7d7cda
-
SHA256
47b91428ab9a5ca4b6449b4fa2f67a750a2de1d924b2b0e85e30223f795bce32
-
SHA512
18008259fc5868d0683c0ef9aff73f79df75544250ff1afe0ec4e0668fc5a1a8116bf727ba73fc73f4efe168991b256eb14c856ce3147e89857fbdf9de3e7ab1
-
SSDEEP
6144:L3PFKs7dizxRJFBfWEqxF6snji81RUinK5qjbkxYubS3:7PhYTBXibkx9b6
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" twyeic.exe -
Executes dropped EXE 1 IoCs
pid Process 1516 twyeic.exe -
Loads dropped DLL 2 IoCs
pid Process 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /b" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /v" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /x" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /m" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /z" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /d" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /q" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /v" 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /w" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /f" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /i" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /r" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /t" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /j" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /a" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /g" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /p" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /y" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /c" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /k" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /e" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /n" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /l" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /s" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /u" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /h" twyeic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\twyeic = "C:\\Users\\Admin\\twyeic.exe /o" twyeic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe 1516 twyeic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe 1516 twyeic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1516 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe 30 PID 3068 wrote to memory of 1516 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe 30 PID 3068 wrote to memory of 1516 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe 30 PID 3068 wrote to memory of 1516 3068 3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ba796b6291f1af40fa7f7910cfe20e0_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\twyeic.exe"C:\Users\Admin\twyeic.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD57620ac26d5d23f7dc466fa08100f9d6b
SHA15bc3eb485f498361329bdf8352d49c129ddd8947
SHA256397e994decc1b086fc0dc8339c11f354103bf5a88a65eec62ee682263dc1ce6f
SHA5125e4533c4b0c78d1f697ed6f1791230dc31731d7d294221165429a6692af5b0d6d7688547add78b4af0a54ccaa2f143fe2c8d2a4a72357e8d9d718cb7eca733f4