Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe
-
Size
152KB
-
MD5
4087135a4e0a07e7c4066979466898c3
-
SHA1
9f578340164a790ce786e43a7d1eb3b5f0761535
-
SHA256
9546c0c4ced4ac6fb5a27f885911e7012137ba94159bbfc5b70d6898b6484aa7
-
SHA512
5e782aa9f75da53dbf6ae02397fc73b7e673eb087438956128e28ae5f276de096b1d3e601dd62b395779a984a13da5508ada3fdadddcd51f62224d7452b49401
-
SSDEEP
3072:DmlkPTYhjIB+7MxJUbaxI3zQyzLBuT+u3:z+7Mxa0yzE
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fuixu.exe -
Executes dropped EXE 1 IoCs
pid Process 2408 fuixu.exe -
Loads dropped DLL 2 IoCs
pid Process 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /m" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /t" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /U" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /i" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /n" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /M" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /W" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /w" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /f" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /H" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /b" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /s" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /S" 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /x" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /P" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /A" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /q" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /z" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /d" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /g" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /Q" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /o" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /G" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /k" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /C" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /l" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /y" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /I" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /R" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /D" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /p" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /v" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /j" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /N" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /Z" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /T" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /u" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /c" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /K" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /e" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /J" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /X" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /S" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /F" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /h" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /O" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /Y" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /E" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /V" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /r" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /L" fuixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\fuixu = "C:\\Users\\Admin\\fuixu.exe /a" fuixu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe 2408 fuixu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe 2408 fuixu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2408 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2408 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2408 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2408 2780 4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4087135a4e0a07e7c4066979466898c3_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\fuixu.exe"C:\Users\Admin\fuixu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD5a45a9c6e84618c94517f5958406f926c
SHA1e09c35450f09a217c1a40e833eeaee1b9b0aca04
SHA2563a406446193eac75c7e99a55b85f81241887c6ba6adf351248bce865d443af6a
SHA512b7c89377955af6262cf7e08f3f215c4d54a4ba16bb57afdebee7a1c468ade439d9f64fe72f0a672616f405d1d299fcce77382d2748860fa849d84b6e66b9e67a