Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 16:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe
-
Size
96KB
-
MD5
4a7f62d34d73aab832094b8ddce089ed
-
SHA1
1f8433f26d91c32908222400525b26ce1e803171
-
SHA256
057711df073bee46785f56fa5971175be47b10aed9b85d9b742fb4b7ac785276
-
SHA512
0a354cf12d6df74215900bac5eb418fc8e521efefe43f7998b6502fe07609d8b9de66c11e0101b2248088ae5c7908043ec666d874619e9504b3af7bc1f00bb42
-
SSDEEP
1536:VTQBHif6cO/hPkGulSc16l6u+NMMl/KlYv1Tq5ThFfNIjnZEP:IBhAlu8CFFfCnyP
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" peejiud.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2852 peejiud.exe -
Loads dropped DLL 2 IoCs
pid Process 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /z" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /T" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /D" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /n" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /w" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /B" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /J" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /X" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /x" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /N" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /L" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /M" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /e" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /m" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /p" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /O" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /b" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /r" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /R" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /k" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /Q" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /g" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /V" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /h" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /u" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /A" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /i" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /P" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /c" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /j" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /F" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /o" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /y" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /H" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /s" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /I" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /v" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /E" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /Y" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /t" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /C" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /d" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /S" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /G" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /K" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /g" 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /a" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /U" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /l" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /q" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /Z" peejiud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\peejiud = "C:\\Users\\Admin\\peejiud.exe /W" peejiud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe 2852 peejiud.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe 2852 peejiud.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2852 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2852 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2852 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2852 2652 4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a7f62d34d73aab832094b8ddce089ed_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\peejiud.exe"C:\Users\Admin\peejiud.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5c0ffeade2915ebec5870c371d1672613
SHA1fd8328dd1856a0f300da0da0552d6cb01427265e
SHA256244adf0ca92539b9ecc58a81f990b239190c4d864d0a66de35eab613f838cd2f
SHA512b68a4904c4557af5fe90ce51dfad72252425cee6af2e5a915ebe22b6e3829fae7f9994293d2f75386625c74779fdeae97caa9012f80f47d87fca26807e241e74