Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe
-
Size
88KB
-
MD5
4356e298c6d4504e5c773aa34e51b71c
-
SHA1
a7aed129acf3b21115ac0224fbaadfaaa55904b9
-
SHA256
ceba2fbdb23ab50da06c03d53b10b9daad057eaa102519de6fd0ad5d34f6c44c
-
SHA512
805b80bf62157e7236754480f8325df2748e693b3c1779c6d92f76728412de1a010cb9eff9395ef5d01bff51afe925da200a26f76adb8aba2b8ce204459e374f
-
SSDEEP
1536:2gH4KSpy8tXG06YpqdXTsYJ/F+FBFIFGFYF7DUZxTZCra:LSs0G0mZLm
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeagook.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 zeagook.exe -
Loads dropped DLL 2 IoCs
pid Process 2640 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 2640 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /m" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /D" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /R" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /M" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /G" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /P" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /T" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /F" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /h" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /n" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /i" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /f" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /e" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /U" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /X" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /B" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /I" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /S" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /d" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /y" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /b" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /x" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /Z" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /Y" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /u" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /s" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /v" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /V" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /W" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /w" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /c" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /g" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /H" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /N" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /K" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /Q" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /a" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /j" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /E" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /q" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /z" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /t" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /o" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /C" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /J" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /p" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /r" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /L" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /O" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /l" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /k" zeagook.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeagook = "C:\\Users\\Admin\\zeagook.exe /A" zeagook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe 2788 zeagook.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2640 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 2788 zeagook.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2788 2640 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 30 PID 2640 wrote to memory of 2788 2640 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 30 PID 2640 wrote to memory of 2788 2640 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 30 PID 2640 wrote to memory of 2788 2640 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\zeagook.exe"C:\Users\Admin\zeagook.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD506ebd4c0f0363e34b883f7148c580624
SHA1f603e734c8bd056225bd73eb1fc213b6d597da1d
SHA256514618525b04d23be523f9acfab5cf7dccd84f1f395a0acf00870e295849365e
SHA51288fd10ef0fbe11339a6a5261e5d89daf2ee8ac19b23ba6841092ff94c464b5b2f35d82e87160818695953c8ac8249f9bed3c6eb79fc137ec052e5a6f1424d078