Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 04:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe
-
Size
204KB
-
MD5
4458d79c132a117afbb60e3640f5c98f
-
SHA1
d3dc92cf9a0ad76a2f1986b8ce525c9a4b53b5e2
-
SHA256
5ec4898858682d44db436c11c237b8a44986e40ba7c64fbeb0be4621bb4436d7
-
SHA512
10d51c19d13e99d20fe9e8d7ef253aee3876fec0b5bc9e536943c4fbe1a761211903e5c513995d08e93a599e9e8570a7e68e2b0113834db00406314ae7bb3cf9
-
SSDEEP
1536:Pa+OoeHo1vzxHwx9xNy3tQ9CW5EZWHakMwP9W6uXNh9h1AWa11GBPIdRONd+w61y:8Ho1k0tQ9nLHbB9WTk9+JgqmlYR
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diiasu.exe -
Executes dropped EXE 1 IoCs
pid Process 2340 diiasu.exe -
Loads dropped DLL 2 IoCs
pid Process 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /d" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /g" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /u" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /o" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /x" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /k" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /i" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /y" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /e" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /t" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /p" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /v" 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /h" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /b" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /j" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /s" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /m" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /q" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /c" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /z" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /f" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /n" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /v" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /w" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /l" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /a" diiasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\diiasu = "C:\\Users\\Admin\\diiasu.exe /r" diiasu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe 2340 diiasu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe 2340 diiasu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2340 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe 31 PID 2324 wrote to memory of 2340 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe 31 PID 2324 wrote to memory of 2340 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe 31 PID 2324 wrote to memory of 2340 2324 4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4458d79c132a117afbb60e3640f5c98f_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\diiasu.exe"C:\Users\Admin\diiasu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD585f75681728065e5968e4081f386dc6c
SHA166448b5e4a0598261ed050ffe771c11488ea62da
SHA256a32cc9e554cfd1d155b471ce123419d057367880e4e2e48b1fbe87e1077e17d2
SHA512b9d2d55352e6398a25fb2d9b7a664240ee4d66a2eff8fdba3a3cbcf167a3e24f2c86dfe8b6ee75936b40d0fe878ca583ba2f4afbeb37634da0ba05ee60837086