Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 21:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe
-
Size
100KB
-
MD5
3ee6d7e901edd4cd091035ca9907140c
-
SHA1
c220c42d59a5d72614796e880444cc16ae3da38b
-
SHA256
1fed4cadf4ae3ad055932c8f29239279af1ea000ade2ac049f343fe4c1298fc0
-
SHA512
ac37df73cc6e19cb253fffe3c8996ba211b476ba5facf843e073486e8383320c18226b37172b2928734983a79a83e7d64b29e66f970199c69d8c8fd538a54048
-
SSDEEP
1536:SZtGW82NTzwd2MGAc4ohrPXo+73Rez8b0SyuNIjnZq:gwd5urPX7CuCnY
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" snjaob.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2428 snjaob.exe -
Loads dropped DLL 2 IoCs
pid Process 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /Q" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /c" 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /p" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /n" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /l" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /D" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /X" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /w" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /S" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /E" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /c" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /U" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /W" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /y" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /r" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /B" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /M" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /A" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /x" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /Y" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /j" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /G" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /f" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /g" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /V" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /e" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /z" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /d" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /F" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /h" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /R" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /H" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /o" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /I" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /P" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /N" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /u" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /L" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /k" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /m" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /O" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /C" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /t" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /K" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /T" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /J" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /v" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /b" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /i" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /Z" snjaob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\snjaob = "C:\\Users\\Admin\\snjaob.exe /s" snjaob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe 2428 snjaob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe 2428 snjaob.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2428 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe 30 PID 2360 wrote to memory of 2428 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe 30 PID 2360 wrote to memory of 2428 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe 30 PID 2360 wrote to memory of 2428 2360 3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ee6d7e901edd4cd091035ca9907140c_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\snjaob.exe"C:\Users\Admin\snjaob.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5a529cf66e45dadb79b844a7897f4bc07
SHA1933c87ada58c7b616c71f555325687b0ae9dfd00
SHA2569ff0bc73123891f636d9809f2f85f14c63b3a0c04946c58d0e1e8c25868d941c
SHA512c6952aebda686b459b301dfd21ceade67d7157c74f916bde685e57306870ad2db410de3306a8be97d960a65db0de37ca4f7fa0445728bc986746c51dc642f68e