Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe
-
Size
160KB
-
MD5
4cd81785fe6b5821abec1ba9835e237c
-
SHA1
dfc16a9a11ebea161efd9ce616d337d0e75f617b
-
SHA256
9c33a8022f64984372940804951eb3ae486d572c9e23047cf500e70b53d686a5
-
SHA512
f2f5d9cdf2b11cf2453f3d18513f38f663540aa542ee50cc71561898781e57993dacdcbbfc21dab80fd170282731182677dfb8a0fc88acb0059a13fd202ef854
-
SSDEEP
3072:KGzsrBnoe5g+GwJs8K9YUoIrJaRuSZ/JlQPj/PYv2wM0B2vmkHgHAGFAhiVE5j4J:KGwrEP9YErMRuSZ/JlQLHYv2PvzGAMA7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" paoezo.exe -
Executes dropped EXE 1 IoCs
pid Process 2112 paoezo.exe -
Loads dropped DLL 2 IoCs
pid Process 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /L" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /s" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /I" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /a" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /E" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /Q" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /A" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /f" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /i" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /C" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /D" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /G" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /V" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /O" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /F" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /r" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /b" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /B" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /z" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /H" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /J" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /o" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /X" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /v" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /Y" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /W" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /S" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /g" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /u" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /M" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /k" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /j" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /R" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /y" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /m" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /n" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /y" 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /p" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /Z" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /x" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /P" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /K" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /d" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /t" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /c" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /T" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /N" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /U" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /q" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /e" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /w" paoezo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\paoezo = "C:\\Users\\Admin\\paoezo.exe /h" paoezo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe 2112 paoezo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe 2112 paoezo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2112 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2112 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2112 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2112 1628 4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4cd81785fe6b5821abec1ba9835e237c_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\paoezo.exe"C:\Users\Admin\paoezo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5d05401a6618db6e4bac46f2223b74893
SHA18792aee5292e27387ba4498b6e38b3e2bbecfdf9
SHA256ea1b2ff5c6218a4d18d2e06320cd5fa652d3d17a33c5701764dae843d055df09
SHA5120e3ac89869562c647e2c501af2aa9be80982145b04a0f36a01f2c4511342e0353c86ddc19fb385808e729e0c87f9e4dbb42f9b4afd47f0b5ddb0af8a9b5b42a2