Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 16:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe
-
Size
176KB
-
MD5
46b5485a2badc8a8d49962aef23ebf61
-
SHA1
8cc9bd937b036fc5fe270c81433e55b9906e2c07
-
SHA256
9a45b9d9372c94699693d5798b357311e6bc648e8a7d9ce2ea094caf22c02af1
-
SHA512
1ccb2d54c787a39bb275a4ce9c8d498646c724fb7a2f6ba27e2d32bf54238432e247b55d0ff0ee9169f683d43fda8b8de1f7932fe28c313746657ab5172728cc
-
SSDEEP
1536:q9BkKaEKrGayc7nRobksF//gYWftTV/b6GZIhdf96K0USn:weKaRrGar7nRobksF/oY4V/b6GZG6K0
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xyvun.exe -
Executes dropped EXE 1 IoCs
pid Process 2852 xyvun.exe -
Loads dropped DLL 2 IoCs
pid Process 2788 46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe 2788 46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /q" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /G" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /p" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /Z" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /E" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /j" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /d" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /N" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /o" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /Y" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /a" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /h" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /y" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /V" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /c" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /b" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /L" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /T" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /D" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /k" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /x" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /X" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /s" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /Q" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /C" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /w" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /K" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /U" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /M" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /z" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /f" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /l" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /m" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /t" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /S" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /n" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /v" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /r" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /F" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /P" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /B" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /H" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /R" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /g" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /e" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /u" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /O" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /A" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /i" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /I" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /W" xyvun.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\xyvun = "C:\\Users\\Admin\\xyvun.exe /J" xyvun.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe 2852 xyvun.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2788 46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe 2852 xyvun.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2852 2788 46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe 31 PID 2788 wrote to memory of 2852 2788 46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe 31 PID 2788 wrote to memory of 2852 2788 46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe 31 PID 2788 wrote to memory of 2852 2788 46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe 31 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30 PID 2852 wrote to memory of 2788 2852 xyvun.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\46b5485a2badc8a8d49962aef23ebf61_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\xyvun.exe"C:\Users\Admin\xyvun.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD5068a972af9e1e5401c78b8de8fdae6c3
SHA1a97ff3fa7ae87cd2ddcc49db9835d206d176d59c
SHA256f8f6434c5b7112cf33ff06f79335578b537e1009d51482b2b2eceb828765b82d
SHA5121d5ddc743d6fa83b6eb617eb41f2fc168ac55cd82fea7b1ded4735d1586dd46206c6e0790b75cf3fc6b09b835cf0b36b6d117f3ae1aac61e5ad8cb423762c6c1