Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13-07-2024 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe
-
Size
88KB
-
MD5
4356e298c6d4504e5c773aa34e51b71c
-
SHA1
a7aed129acf3b21115ac0224fbaadfaaa55904b9
-
SHA256
ceba2fbdb23ab50da06c03d53b10b9daad057eaa102519de6fd0ad5d34f6c44c
-
SHA512
805b80bf62157e7236754480f8325df2748e693b3c1779c6d92f76728412de1a010cb9eff9395ef5d01bff51afe925da200a26f76adb8aba2b8ce204459e374f
-
SSDEEP
1536:2gH4KSpy8tXG06YpqdXTsYJ/F+FBFIFGFYF7DUZxTZCra:LSs0G0mZLm
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lueilem.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2244 lueilem.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /W" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /J" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /g" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /o" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /z" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /T" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /R" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /P" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /S" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /X" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /G" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /u" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /c" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /n" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /M" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /k" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /A" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /V" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /x" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /f" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /a" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /i" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /Q" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /N" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /D" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /q" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /b" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /m" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /Z" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /d" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /h" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /E" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /Y" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /j" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /y" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /L" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /U" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /l" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /w" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /C" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /p" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /B" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /s" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /F" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /v" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /t" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /r" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /e" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /H" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /O" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /K" lueilem.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lueilem = "C:\\Users\\Admin\\lueilem.exe /I" lueilem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe 2244 lueilem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2656 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 2244 lueilem.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2244 2656 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 86 PID 2656 wrote to memory of 2244 2656 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 86 PID 2656 wrote to memory of 2244 2656 4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4356e298c6d4504e5c773aa34e51b71c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\lueilem.exe"C:\Users\Admin\lueilem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2244
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5d2c0287368c124fdb8b3da8cb653d346
SHA162dabd923726ea2944bdfae1e230c6c249cb309c
SHA256dde42a52f60fb76a53b33c89008043366a3241001571beba46eec99b3b69511f
SHA512fe277432d007c3f2a5a5102cfd45de5985a67db29109fec035f18f26a20bb2ca29a1cc0eb9f0bd75292d46be6d12ef4f87984bfa7e7bbd6c4089477c7de9ddad