Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 09:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe
-
Size
136KB
-
MD5
5b7474dd4f0da817a93138b230204561
-
SHA1
44bf13d065b4993ca33e673fbd23a80723dcbe0b
-
SHA256
2c3fb6f9a7b7d5157e6adf14e84a6fbc91a010d92ef81a840e5acc3a2f063684
-
SHA512
a90b109419406f719ead1c93bb2225ad2ae51f5e47ff2b49af9da9f680c6381d12a3f8601e8793c1deac962a5c1b828df4ab550255fa483789667f674a73308a
-
SSDEEP
3072:Bmb6PawjBfQn7WbIqH0ybZBiOllyEmcP82+aVdOt66VGegmM:Bm4xQn7WbIqH0ybZBiOllyE5D+aVkjse
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" waohua.exe -
Executes dropped EXE 1 IoCs
pid Process 2948 waohua.exe -
Loads dropped DLL 2 IoCs
pid Process 2824 5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe 2824 5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /S" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /F" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /t" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /H" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /h" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /Z" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /W" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /O" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /s" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /V" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /K" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /T" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /w" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /M" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /b" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /p" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /Q" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /r" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /P" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /i" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /j" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /d" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /x" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /k" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /y" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /v" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /X" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /a" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /u" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /n" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /e" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /D" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /G" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /C" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /z" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /o" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /B" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /E" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /g" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /c" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /A" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /U" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /m" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /f" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /I" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /q" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /L" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /N" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /J" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /l" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /Y" waohua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\waohua = "C:\\Users\\Admin\\waohua.exe /R" waohua.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe 2948 waohua.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2824 5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe 2948 waohua.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2948 2824 5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe 30 PID 2824 wrote to memory of 2948 2824 5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe 30 PID 2824 wrote to memory of 2948 2824 5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe 30 PID 2824 wrote to memory of 2948 2824 5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b7474dd4f0da817a93138b230204561_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\waohua.exe"C:\Users\Admin\waohua.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD51e487fc48971b1ce1a96960ca179911a
SHA164ac882de06184fac41c6cf17add21f1305c6550
SHA2564c2b19584888f174bd282781cd8c5e70e39ff8bb9bfac48d91e5d3c9579cbe50
SHA51295c2a31dfa2482f67714f56669bccd4e57e1279a7d718f5ab648e2a1a59ef64b3b75299aed9034891d9e11c72108d6e5089496b957ca60cceec644d8ef6e9305