516124bbc6ab5379b46e5c923a0b269a29ea272f6c5439f73c48a46ca90e7ef9

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe
Size

312KB
MD5

5c14b50a5f12f46ef7d436359e6da0b7
SHA1

8fd55abdff20b6bf3dab63d87032fab3aa8c8f2c
SHA256

516124bbc6ab5379b46e5c923a0b269a29ea272f6c5439f73c48a46ca90e7ef9
SHA512

f11c37ed65f4e321877ac93b2416d7c56833f30a13ba57ba09bc75c827c910ccb716f513b15e4cb95106f7c3035ddd9a08c7fbfa19df844996a301b1621acb9d
SSDEEP

6144:gPbc0f7XP+g3AGJpWVzuNRHeEgRK/fObT/bGiJKv6R7MkZ4lUr8W9HuOGKhvsMMF:Ew27/XvLWpuPeEgRK/fObT/bGiJlMkZg

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jgmit.exe

Executes dropped EXE 1 IoCs

pid	Process
1004	jgmit.exe

Loads dropped DLL 2 IoCs

pid	Process
2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe
2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /P"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /M"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /k"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /Y"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /W"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /w"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /V"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /c"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /R"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /n"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /Z"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /Q"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /A"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /F"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /L"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /G"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /g"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /d"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /X"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /x"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /t"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /u"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /H"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /S"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /z"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /s"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /l"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /I"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /h"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /T"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /J"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /y"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /f"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /a"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /D"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /B"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /p"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /m"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /q"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /e"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /N"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /O"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /C"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /v"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /E"	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /j"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /U"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /i"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /K"	jgmit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\jgmit = "C:\\Users\\Admin\\jgmit.exe /r"	jgmit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe
1004	jgmit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe
1004	jgmit.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1004	2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe	29
PID 2204 wrote to memory of 1004	2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe	29
PID 2204 wrote to memory of 1004	2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe	29
PID 2204 wrote to memory of 1004	2204	5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c14b50a5f12f46ef7d436359e6da0b7_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\jgmit.exe
  "C:\Users\Admin\jgmit.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\jgmit.exe

Filesize
312KB

MD5
c7576278076da8056226d1cddcd2cadf

SHA1
2b6d3e77b520d063f6960d915c43d79657cd9512

SHA256
3375bcd545145a83eb3011056f1239b112a51dd7dd578e4319339a5f706fd0ee

SHA512
412991d7816243280e7d7cb78e0015f04c86560c4a79308bc8d0f359f68d6a35e5a1b7849518a12f387520967ce3023fbb0410b47be5593e67207ce445d0ff98

Download Submit